Fix an OOB write in SDP_AddAttribute

When the `attr_pad` becomes full, it is possible
that un index of `-1` is computed write
a zero byte to `p_val`, rusulting OOB write.

```
  p_val[SDP_MAX_PAD_LEN - p_rec->free_pad_ptr - 1] = '\0';
```

Bug: 261867748
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I937d22a2df26fca1d7f06b10182c4e713ddfed1b
Change-Id: I937d22a2df26fca1d7f06b10182c4e713ddfed1b
(cherry picked from commit 0846b5b7)
Merged-In: I937d22a2df26fca1d7f06b10182c4e713ddfed1b