want better runtime isolation of sled components from ENOSPC

[davepacheco]

See #7221. Currently, Crucible regions have both a quota and a reservation. Control plane zones have neither. This means that if the control plane makes a mistake and puts too much on the same system, or if anything on the system doesn't have a quota or if the sum of quotas exceeds the total available space, then the control plane components can wind up running out of disk space even when they're not using very much at all.

I think the easiest thing to do here would be to pick generous limits and use both a quota and reservation for both zone root filesystems and persistent data filesystems. This should avoid overprovisioning entirely. These values would probably have to be deployment-specific, since the values for production probably won't work for, say, a4x2.

The downside of this is that it might lead to lower total disk utilization when the system is full. If that becomes a problem (it does not seem remotely like one of our major problems right now) we could explore smarter options that involve more work.

[davepacheco]

Related: #1630.