Update the allocator to not offer unreserved resources beyond quota.

Eventually, we will want to offer unreserved resources as revocable beyond the role's quota. Rather than offering non-revocable resources beyond the role's quota's guarantee, in the short term, we choose to not offer resources beyond a role's quota.