Fix OOB read in add_attr

It is possible in exceptional cases for add_attr to be passed a p
pointer one byte short of its p_end pointer, which leads to an OOB read
as it attempts to read the type of the next attribute.

Add a check for this.

Bug: 367274727
Test: m libbluetooth
Ignore-AOSP-First: security
Tag: security
Flag: EXEMPT trivial validity check
(cherry picked from commit a1dee2af)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:655ceaa67a408f37c8e432e97bea0bcedeb8f478)
Merged-In: I4b5fcbce3c0f6a767356593aade7d7d871da974c
Change-Id: I4b5fcbce3c0f6a767356593aade7d7d871da974c