ncsi: bounds-check OEM command bodies before dereferencing them

ncsi_input() validates pkt_len only against the NC-SI common header
(sizeof(struct ncsi_pkt_hdr) = 16) -- the check added for CVE-2020-29129.
The OEM command dispatch, added afterwards, reads further into the frame
with no additional length check:

  * ncsi_rsp_handler_oem() reads cmd->mfr_id at NC-SI payload offset 16
    (frame offset ETH_HLEN + 16 = 30) and reflects it into the response
    (rsp->mfr_id = cmd->mfr_id) before the mfr_id match test -- so a guest
    OEM frame of 30..33 bytes causes an out-of-bounds read whose bytes are
    sent back to the guest (info leak). Unconditional.

  * when the host is configured as Mellanox (mfr_id == 0x8119),
    ncsi_rsp_handler_oem_mlx() then reads cmd_rev/cmd/param/optional from
    cmd->data (payload offset 20, frame offset 34) -- a guest frame of
    34..37 bytes reads out of bounds there too.

Both are guest-triggerable out-of-bounds reads of the raw RX buffer and a
residual of CVE-2020-29129 (which covered only the common header). They
were found by fuzzing the NC-SI path (which upstream does not fuzz) with a
guard-page allocator: 30/31/32-byte frames fault at ncsi.c:136, a 37-byte
frame faults at ncsi.c:107.

Reject OEM frames too short to contain the fields the handlers read.

  sizeof(struct ncsi_cmd_oem_pkt)      == 20  -> generic OEM min 34 bytes
  + sizeof(struct ncsi_rsp_oem_mlx_pkt) == 4  -> Mellanox     min 38 bytes