Replace subtraction of Instants and Durations with saturating subtractions (#12549)

# Description
Duration can not be negative, and an underflow causes a panic.

This should fix #12539 as from what I can tell that bug was caused in
`nu-explore:📟:events` from subtracting durations, but I figured
this might be more widespread, and saturating to zero generally makes
sense.

I also added the relevant clippy lint to try to prevent this from
happening in the future. I can't think of a reason we would ever want to
subtract durations without checking first.

cc @fdncred

# Tests + Formatting
- 🟢 `toolkit fmt`
- 🟢 `toolkit clippy`
- 🟢 `toolkit test`
- 🟢 `toolkit test stdlib`

crates/nu-command/src/debug/timeit.rs

@@ -63,7 +63,10 @@ impl Command for TimeIt {
 
         let end_time = Instant::now();
 
-        let output = Value::duration((end_time - start_time).as_nanos() as i64, call.head);
+        let output = Value::duration(
+            end_time.saturating_duration_since(start_time).as_nanos() as i64,
+            call.head,
+        );
 
         Ok(output.into_pipeline_data())
     }