PrioritizedQueue: cap costs at max_tokens_per_subqueue

Otherwise, you can get a recovery op in the queue which has a cost
higher than the max token value.  It won't get serviced until all other
queues also do not have enough tokens and higher priority queues are
empty.

Fixes: #7706
Signed-off-by: Samuel Just <sam.just@inktank.com>
(cherry picked from commit 2722a0a487e77ea2aa0d18caec0bdac50cb6a264)