outputWithTimestamp() accepts timestamps that will fail preconditions

We have accidentally created events with *wrong* timestamps in the future which are accepted by
outputWithTimestamp(), but will fail at a later step:

java.lang.IllegalStateException: Timer 472976-06-15T20:09:57.269Z is beyond end-of-time
at Preconditions.checkState(Preconditions.java:199)
at ReduceFnRunner.scheduleEndOfWindowOrGarbageCollectionTimer(ReduceFnRunner.java:1050)
[...]

Would it make sense to implement a check already at outputWithTimestamp() level to fail early?

Imported from Jira [BEAM-1408](https://issues.apache.org/jira/browse/BEAM-1408). Original Jira may contain additional context.
Reported by: andyxu.

Start by locating outputWithTimestamp() and tracing how its timestamp reaches ReduceFnRunner.scheduleEndOfWindowOrGarbageCollectionTimer(). Review the preconditions in Preconditions.java and the reported beyond-end-of-time failure; done means invalid future timestamps fail at outputWithTimestamp() rather than at the later timer step.

Written by the indexing model from the issue text.