intel_dsi_vbt: MIPI sequence execution walks the kmemdup'd VBT blob with no end bound — heap OOB read via i2c/spi/delay/gpio elements and the operation loop

Summary

exec_sequence iterates elements until a 0x00 byte with no bound against the end of the kmemdup'd blob - vbt.dsi.size is stored precisely for this but never consumed. Every element handler dereferences past the blob on a truncated/desynced VBT: i2c reads *(data+6) and skips up to 262B, spi reads *(data+5), delay reads a u32, gpio reads 2-3 bytes; v1/v2 walks silently re-sync on garbage. Parse-time walkers are partial and v3 sizes are FIXME-unchecked - execution is the last line of defense and has none. Crafted-VBT model (DF-1770..1773/4121..4123 class); crash DoS holding mode_config mutex, no direct disclosure. Thread-the-end-pointer fix.