ARPQuerier: add ENTRY_PACKET_CAPACITY

This parameter limits how many packets an ARPQuerier stores for any
given ARP entry. The default (and existing behaviour) is to store an
unlimited number of packets (subject to PACKET_CAPACITY).  A packet that
arrives for an ARP entry that has reached ENTRY_PACKET_CAPACITY is
dropped.

Also, fix a packet leak for the case that append_query() returns
-ENOMEM.  Previously, this leak probably wasn't that important /
noticeable since it would only occur on memory allocation failure.
However, we now hit this case whenever ENTRY_PACKET_CAPACITY is
exceeded.

Reviewed-by: asa@meraki.com