[roll] Roll fuchsia [dwc3] Prevent transfer size integer underflow

When completing a TRB in UserEpCompleteTransfers and
HandleEp0TransferCompleteEvent, the driver calculates the transferred
byte count by subtracting TRB_BUFSIZ(trb.status) from the requested
transfer length using unsigned arithmetic. If the controller reports a
remaining byte count larger than the programmed transfer size (such as
on a babble condition), the subtraction underflows and produces a huge
transfer size.

Check whether TRB_BUFSIZ(trb.status) exceeds the expected transfer
length on user endpoints and EP0 (both DataOut and DataIn states)
before subtracting, logging an error and clamping the completed byte
count to 0. Add unit tests covering babble underflow on user endpoints
and EP0.

Original-Original-Fixed: 529461165
Test: fx test dwc3-test
Original-Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1855403
Original-Original-Revision: 0f676f40b02fd22132325478ee268aa721efa9df
GitOrigin-RevId: 3da4c045f6dfd33b53602dbaac5e6450e9c90b9b
Change-Id: Ia1e92779d1073c3bd154ba35ad62a9735027a932
Reviewed-on: https://fuchsia-review.googlesource.com/c/integration/+/1859715
Cr-Commit-Position: refs/heads/main@{#203841}