ceph: fix off by one bugs in unsafe_request_wait()

The "> max" tests should be ">= max" to prevent an out of bounds access
on the next lines.

Fixes: e1a4541e ("ceph: flush the mdlog before waiting on unsafe reqs")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>