altos: Replace ao_alarm/ao_clear_alarm with ao_sleep_for

Having arbitrary alarms firing in the middle of complicated device
logic makes no sense at all. Therefore only correct use of ao_alarm
and ao_clear_alarm was around a specific ao_sleep call, with correct
recovery in case the alarm fires.

This patch replaces all uses of ao_alarm/ao_sleep/ao_clear_alarm with
ao_sleep_for, a new function which takes the alarm timeout directly.

A few cases which weren't simply calling ao_sleep have been reworked
to pass the timeout value down to the place where sleep *is* being
called, and having that code deal with the return correctly.

Signed-off-by: Keith Packard <keithp@keithp.com>