Fix OOB read in add_attr

It is possible in exceptional cases for add_attr to be passed a p
pointer one byte short of its p_end pointer, which leads to an OOB read
as it attempts to read the type of the next attribute.

Add a check for this.

Bug: 367274727
Test: m libbluetooth
Ignore-AOSP-First: security
Tag: security
Flag: EXEMPT trivial validity check
Change-Id: I4b5fcbce3c0f6a767356593aade7d7d871da974c