add a TimerGuard around db locks & ops

I moved the clocks member from LockedDatabase to Database to make this happen,
so the new DatabaseGuard (replacing a direct MutexGuard<LockedDatabase>) can
access it before acquiring the lock.

I also made the type of clock a type parameter of Database (and so several
other things throughout the system). This allowed me to drop the Arc<>, but
more importantly it means that the Clocks trait doesn't need to stay
object-safe. I plan to take advantage of that shortly.

base/clock.rs

@@ -62,7 +62,7 @@ pub fn retry_forever<T, E: Into<Error>>(clocks: &Clocks, f: &mut FnMut() -> Resu
     }
 }
 
-#[derive(Clone)]
+#[derive(Copy, Clone)]
 pub struct RealClocks {}
 
 impl RealClocks {