cmd/praefect: Check of the system clock synchronization

Because check of the authentication token depends on the time
we need to make sure it is synced on the praefect machine and
all gitaly machines that belong to the cluster. That is why
a new check point is added to the 'check' sub-command of the
praefect binary. The task should be run on the praefect node
and doesn't require praefect to be up and running. It is possible
to configure the URL of the NTP service and acceptable time
offset via env variables NTP_URL and ALLOWED_OFFSET_MILLIS.
The check has fatal severity because the cluster won't work
correctly if auth checks fail continuously for each request.