fix: validate wall clock when submitting a voluntary exit message

[syjn99]

What type of PR is this?

Bug fix

What does this PR do? Why is it needed?

If a user submit an voluntary exit message with a valid signature(via POST /eth/v1/beacon/pool/voluntary_exits), the current implementation never checks the validation of its exit epoch. It seems VerifyExitAndSignature has that validation logic, but the headState passed to the function is already processed until the exit_epoch, so the following code will never help.

	// Exits must specify an epoch when they become valid; they are not valid before then.
	if currentEpoch < exit.Epoch {
		return fmt.Errorf("expected current epoch >= exit epoch, received %d < %d", currentEpoch, exit.Epoch)
	}

e9314c5 contains an example of this scenario: the current wall epoch is 256, but a "valid" exit message whose exit_epoch is 500 can be accepted in the handler.

This could be a severe problem for the node who received the POST request, as it will broadcast the message that other nodes will eventually mark as "invalid". By rejecting that gossip message, the node's reputation would be worse, leading a disconnection problem.

I found lighthouse has its validation logic before broadcasting the exit message. I added a simple implementation using GenesisTimeFetcher like it.

Other notes for review

I'm quite unconfident of introducing voluntaryExitEpochValidationBuffer, which will accept an exit message with in a very near future(~5 epoch). Feel free to give an opinion of this.

Acknowledgements

• I have read CONTRIBUTING.md.
• I have made an appropriate entry to CHANGELOG.md.
• I have added a description to this PR with sufficient context for reviewers to understand this PR.