admission: improve error correction for CTT deductions

Per-request token deductions use model estimates from `cpuTimeTokenEstimation`, but the model is only updated every 1s. During the 1s window between model updates, stale estimates can cause systematic over-deduction or under-deduction with no correction.

1. Over a 1ms interval, deduct tokens using the per-request model as today. Let R1 be the total model-based deductions in that interval.
2. At the end of the 1ms interval, sample actual CPU consumption (via grunning). Let R2 be the observed consumption.
3. Additionally deduct R2 - R1 from the token bucket, so the effective deduction over the interval equals R2 (actual consumption).

This is the same pattern already implemented for disk bandwidth tokens. The infrastructure for 1ms ticks already exists in `cpuTimeTokenFiller`.

This improvement is particularly important for resource groups operating at high utilization targets (e.g., 100% CPU limit), where model inaccuracy can cause unnecessary throttling. See #168386 for that discussion.

Epic: none

Jira issue: CRDB-62934

Epic CRDB-66387