PrioritizedQueue: cap costs at max_tokens_per_subqueue

Otherwise, you can get a recovery op in the queue which has a cost
higher than the max token value.  It won't get serviced until all other
queues also do not have enough tokens and higher priority queues are
empty.

Fixes: #7706
Signed-off-by: Samuel Just <sam.just@inktank.com>
config_opts: raise ms_pq_max_tokens_per_priority to 16MB

Recovery messages can get pretty big.

Signed-off-by: Samuel Just <sam.just@inktank.com>
Merge pull request #1452 from ceph/wip-7706

Wip 7706

Reviewed-by: Greg Farnum <greg@inktank.com>