Camera: Avoid dequeue too many buffers from buffer queue

The PreviewFrameSpacer could defer 1 or 2 buffers to reduce jitter.
And we update the handout buffer count at the time of queuing to
the preview frame spacer, not at the time of queuing to the buffer
queue.

This results in accounting mismatch where the framework could allow
the HAL to dequeue more buffers than supported.

The fix is to track the framework cached buffer count in addition to the
handout buffer count.

Test: Camera CTS, vendor testing, observe logcat with GoogleCamera
Bug: 242674531
Change-Id: I579ae7465b59f5bd9e12dfda332998b401793eb4
diff --git a/services/camera/libcameraservice/device3/Camera3OutputStream.h b/services/camera/libcameraservice/device3/Camera3OutputStream.h
index 1b4739c..741bca2 100644
--- a/services/camera/libcameraservice/device3/Camera3OutputStream.h
+++ b/services/camera/libcameraservice/device3/Camera3OutputStream.h
@@ -259,6 +259,7 @@
 
     void setImageDumpMask(int mask) { mImageDumpMask = mask; }
     bool shouldLogError(status_t res);
+    void onCachedBufferQueued();
 
   protected:
     Camera3OutputStream(int id, camera_stream_type_t type,