Buffer pool unpinned invariant does not take into account multiply-pinned bytes

While working on converting the BufferedBlockMgr test I discovered that the "dirty unpinned bytes <= unused reservation" invariant is too strict. It should be "dirty unpinned bytes <= unused reservation + multiply pinned bytes", since pinning a page multiple times does not require additional buffers.

I was able to prove the bug by adding a DCHECK for the previous invariant. Pinning a page multiple times could violate the invariant (harmlessly, aside from waiting for some extra I/O).