nap time between pats is forced to be at most half of the timeout

Previously, if the timeout was less than 10 seconds, for example, about
8 seconds, then the watchdog timer would be let to expire before patting
the watchdog.

MFC after: 2 weeks