serial: bounds-check transaction index in bitbang drivers

[arcaartem]

Description

The bitbang split serial drivers index split_transaction_table with values that are either taken straight off the wire or insufficiently bounded:

• In platforms/chibios/drivers/serial.c, interrupt_handler() (the target-side ISR) read the transaction index from the wire with serial_read_byte() and used it to index split_transaction_table with no bounds check at all. A corrupted or hostile index results in an out-of-bounds struct read and an arbitrary function-pointer call through trans->slave_callback.
• initiate_transaction() in the same file checked the index with > instead of >= against NUM_TOTAL_TRANSACTIONS, allowing an index one entry past the end of the table.
• platforms/avr/drivers/serial.c had the same > vs >= off-by-one in both the target ISR and soft_serial_transaction().

The new ISR check bails out before the table is indexed. The early-out releases the serial line back to input and the chSysLockFromISR() critical section the same way the normal exit path does (the shared-memory lock is a cleanup-attribute guard and releases itself); sync_send() earlier in the handler leaves the pin driven as output, so skipping that release would leave the line stuck driven and prevent the target's falling-edge interrupt from ever firing again. Dropping the transaction on the target side causes the initiator's transaction to fail, the same outcome as any other corrupt transaction.

The vendor UART driver (platforms/chibios/drivers/serial_protocol.c) already performs this check correctly with >=; this change brings the bitbang drivers to parity with it.

Types of Changes

• Core
• Bug fix
• New feature
• Enhancement/optimization
• Keyboard (addition or update)
• Keymap/layout/userspace (addition or update)
• Documentation

Checklist

• My code follows the code style of this project: qmk format-c applied, diff is noise-free.
• I have read the CONTRIBUTING document.
• My change targets the develop branch.
• My change is restricted to one logical change (core only, no keyboard/keymap mixed in).
• Compile-verified against crkbd/rev1:default (AVR soft serial, builds platforms/avr/drivers/serial.c) and handwired/splittest/bluepill:bitbang (ChibiOS with SERIAL_DRIVER = bitbang, builds platforms/chibios/drivers/serial.c).

[arcaartem]

Fixed a defect in the new early-out path: it released the ISR critical section but left the serial line driven as output (sync_send() leaves the pin as output), so on a corrupted index the target's falling-edge interrupt could never fire again and the link would wedge. The bail-out now calls serial_input() first, mirroring the normal exit path. Both targets re-compiled.