config: clamp overdue TTL timer duration to zero (#46871)

<!--
!!!ATTENTION!!!

If you are fixing **any** crash or **any** potential security issue,
**do not
open a pull request**.

Instead, please
[open a GitHub Security
Advisory](https://github.com/envoyproxy/envoy/security/advisories/new)
(preferred). Alternatively, you may email
envoy-security@googlegroups.com.

Thank you in advance for helping to keep Envoy secure.

!!!ATTENTION!!!

For an explanation of how to fill out the fields, please see the
relevant section
in
[PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md)

!!!ATTENTION!!!

Please check the [use of generative AI
policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41).

You may use generative AI only if you fully understand the code. You
need to disclose
this usage in the PR description to ensure transparency.
-->

Commit Message: config: clamp overdue TTL timer duration to zero
Additional Description: 

When `TtlManager::refreshTimer()` recalculates the duration for the next
TTL expiration, `time_source_.monotonicTime()` may have already
surpassed the target expiry (e.g. due to execution time in the TTL
expiration callback or thread scheduling delays).

Fixes test flake:

```
  [ RUN      ] IpVersionsClientType/NetworkExtensionDiscoveryIntegrationTest.BasicSuccessWithTtlWithDefault/1
  [2026-08-21 14:40:01.523][14653][error][envoy_bug] [./source/common/event/timer_impl.h:33] envoy bug failure: false. Details: Negative duration passed to durationToTimeval(): -1
```

This could also theoretically happen in production though IIUC.

Risk Level: Low
Testing: Added unit test `TtlManagerTest.OverdueTtl` in
`test/common/config/ttl_test.cc` and verified all
`//test/common/config/...` tests pass.
Docs Changes: N/A
Release Notes: N/A

I used generative AI to help make this change.

---------

Signed-off-by: antoniovleonti <leonti@google.com>