Fix an OOB write in SDP_AddAttribute

When the `attr_pad` becomes full, it is possible
that an index of `-1` that is used to write a zero
byte to `p_val` (in the following statement),
resulting OOB write.

```
  p_val[SDP_MAX_PAD_LEN - p_rec->free_pad_ptr - 1] = '\0';
```

Bug: 261867748
Test: manual
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I937d22a2df26fca1d7f06b10182c4e713ddfed1b