On a per device basis, limit the amount of async I/O going down to
devices. If we're over the limit, we wait for the I/O to finish. We use
our own custom waiting mechannism since we have to coordinate with
departure events at this level.

The current limit is some tiny percentage of the capacity of the
g_consumer that's being opened (if we don't know the size, we're
unlimited, though that's a very atypical case). There's different
percentages for SSDs and HDDs.

In the future, this limit could be informed by hints that the I/O
scheduler sends back up to g_vfs_strategy after it schedules the I/O.

Sponsored by: Netflix
Assisted-by: Claude Code (Sonnet 5)