Fix bounds check underflow and GKI buffer leak in T4T write

Add checks to ensure that p_t4t->max_update_size is larger than the
data_header size before calculating data_length. This prevents a potential underflow when the maximum update size is insufficient for the ODO/DDO header. Additionally, ensure that the allocated C-APDU buffer (p_c_apdu) is freed via GKI_freebuf(p_c_apdu) before returning false on these new safety check paths in rw_t4t_set_ber_tlv() to prevent GKI buffer memory leaks.

Bug: 498891727
Bug: 508389525
Test: Manual
Flag: EXEMPT BUGFIX
(cherry picked from commit 91208e26395b1ac6ffb38e5d1bb9abf366ed8134)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:6f500e02dda2ca267224403bbf84967f2063e9b7
Merged-In: Ia2fb76f73a5f3e99476922101a43d3d8b0505214
Change-Id: Ia2fb76f73a5f3e99476922101a43d3d8b0505214