safexcel: Handle command/result descriptor exhaustion gracefully

Rather than returning a hard error in this case, return ERESTART so that
upper layers get a chance to retry the request (or drop it, depending on
the desired policy).

This case is hard to hit due to the somewhat low bound on queued
requests, but that will no longer be true after an upcoming change.

Sponsored by: Rubicon Communications, LLC (Netgate)

(cherry picked from commit b7e27af36b7df05f4b6cdc706750413f3a048640)