(7/7) Refuse to resume a suspended slot past its expiry

What does this MR do?

Builds on !117 (merged) (target branch).

• Resume refuses a slot past its expiry with ErrSlotExpired, before any cloud resume and under the same lock as ExpireSuspended. No grace applies here. Before this, a resume between the expiry and the next sweep started the VM and was refused only by the runner afterwards.
• ErrAcquisitionNotFound: Resume wraps it when the key is unknown or its instance is gone (for example, an expired stopped instance was deleted), so callers can tell a lost environment from a retryable failure.
• gofmt alignment in cron/expression_test.go.

Why was this MR needed?

A resume past the expiry must not boot the instance or adopt the environment.

What's the best way to test this MR?

go test -race -run 'TestResume' .

What are the relevant issue numbers?

Used by gitlab-org/gitlab-runner!7646 (merged) and its follow-ups.

MR stack

Merge in order:

1. (1/7) Give acquired slots an optional expiry (!117 - merged) • Ashvin Sharma
2. (2/7) Let an instance mark a suspended slot exp... (!119 - merged) • Ashvin Sharma
3. (3/7) Expire suspended slots past their expiry (!120 - merged) • Ashvin Sharma
4. (4/7) Expose connect info for an expired slot's... (!121 - merged) • Ashvin Sharma
5. (5/7) Free expired slots once their workload is... (!122 - merged) • Ashvin Sharma
6. (6/7) Remove stopped instances whose slots have... (!123 - merged) • Ashvin Sharma
7. (7/7) Refuse to resume a suspended slot past it... (!118 - merged) • Ashvin Sharma (this MR)