safexcel: Handle command/result descriptor exhaustion gracefully

Rather than returning a hard error in this case, return ERESTART so that
upper layers get a chance to retry the request (or drop it, depending on
the desired policy).

This case is hard to hit due to the somewhat low bound on queued
requests, but that will no longer be true after an upcoming change.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC (Netgate)