Bluetooth: SDP: Fix possible out of bound memory access

buf->len should be validated before accessing it since remote can
send invalid frame_len which can result in out of bound memory
access.

This also fix the len check wrt cstate, since current check is
not considering the cstate length size and frame_len size.

Jira: ZEP-2110
Signed-off-by: Jaganath Kanakkassery <jaganathx.kanakkassery@intel.com>