fix for DF-4179: twe_add_unit bound check is off by one.

`unit > TWE_MAX_UNITS` admits unit == TWE_MAX_UNITS (16) while
sc->twe_drive[] has only TWE_MAX_UNITS (16) elements (indices 0..15).
twe_del_unit already uses the correct `>=` comparison.  With unit == 16 the
ioctl path TWEIO_ADD_UNIT takes `dr = &sc->twe_drive[16]` and writes
controller-derived geometry into the first out-of-bounds struct twe_drive,
which overlaps sc->twe_aen_queue[] in struct twe_softc, then attaches a
"ghost" disk whose td_twe_unit (16) is later truncated into the 4-bit
cmd->io.unit field, directing I/O at unit 0.
--- a/sys/dev/raid/twe/twe.c
+++ b/sys/dev/raid/twe/twe.c
@@ -209,7 +209,7 @@
     TWE_Array_Descriptor	*ud;
 
     TWE_CONFIG_ASSERT_LOCKED(sc);
-    if (unit < 0 || unit > TWE_MAX_UNITS)
+    if (unit < 0 || unit >= TWE_MAX_UNITS)
 	return (EINVAL);
 
     /*