Validate expiry instants

Throw if user specifies an Instant that would overflow the unsigned 32-bit expiry value in the wire protocol, or would be interpreted as a relative duration.

Throw if a user specifies a Duration longer than 50 years.