crimson/osd: gate writes at OSDOp boundary when local store is full

When SeaStore runs out of space, allocations in object_data_handler.cc hit
enospc::assert_failure and abort the OSD. Gating on monitor OSDMap pool FULL
flags alone is insufficient: flag propagation lags by seconds-to-minutes and
cannot protect the local allocator from sudden exhaustion.

Add a local failsafe gate at the OpsExecuter boundary, Crimson's analog of
classic's osd_failsafe_full_ratio check (PrimaryLogPG.cc:2162). Data-allocating
ops (CREATE/WRITE/WRITEFULL/WRITESAME/APPEND/COPY_FROM2) are dropped with
-EAGAIN so the client resends, matching Crimson's existing mon-driven full path
(the "drop request" case in pg.cc) and classic's silent drop. This keeps
behavior uniform regardless of whether pool full flags have reached the client
yet. CEPH_OSD_FLAG_FULL_TRY is exempt; space-reclaiming ops
(ZERO/TRUNCATE/ROLLBACK) are deliberately not gated. The mon-driven pool
FLAG_FULL path in run_executer is untouched and remains authoritative.

The threshold uses the store's statfs accounting (stats.used_bytes). The
follow-on (#69352) moves RBM capacity checks to the allocator's authoritative
view and wires mon-side NEARFULL/FULL via statfs, so clients get a clean stop
rather than resend-until-resolved.

Signed-off-by: Shai Fultheim <shai.fultheim@gmail.com>