Fix OOB read in add_attr

It is possible in exceptional cases for add_attr to be passed a p
pointer one byte short of its p_end pointer, which leads to an OOB read
as it attempts to read the type of the next attribute.

Add a check for this.

Bug: 367274727
Test: m libbluetooth
Ignore-AOSP-First: security
Tag: security
Flag: EXEMPT trivial validity check
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c1eb2120b77d71bdccd8eb46e6cfa15c41beae07)
Merged-In: Ic3079c4c2d6933355cf4e8444e8f25ebedeafefe
Change-Id: Ic3079c4c2d6933355cf4e8444e8f25ebedeafefe