Tokens spent on failed operations are lost

If allocate_buckets, slot_readv_and_testv_and_writev, add_leases, or renew_leases operation fails in a way that doesn't allocate storage, the tokens extracted from the local database which were included in that operation are lost while also being unspent.

Since the tokens are effectively money, this is somewhat undesirable. It might even be highly costly if a misconfiguration or a network error causes a failing operation to be retried many times (perhaps until all existing tokens have been lost).

To the greatest extent possible, tokens should not be lost because an attempt is made to use them for an operation that eventually fails.