usb: obmf: update wire protocol to OBMF-ICP v1.0.0 RC1

[minying0829]

Update the driver to match the finalized v1.0.0 RC1 wire format, which is not backward compatible with the earlier v0.9 draft.

Common Header (4 bytes, was 5):

• Drop the per-message Channel Type byte; the type is already known from the channel that was discovered on Channel 0, so it no longer needs to be repeated on every transfer.
• Merge RqResp and Status into a single byte (status_rqresp): RqResp is now bit 7, Status is bits [6:0] (previously RqResp was bit 0 and Status was bits [7:1]).
• Update obmf_send_request()/obmf_send_response() and every caller (GPIO, I2C, I2C target, I3C, IPMI, OEM, serial, SPI, MMIO, IO) to drop the now-removed channel_type argument.

MMIO Sub-Header (1 byte, was 2):

• Drop the Tag byte; MMIO requests/responses are no longer tagged.
• Widen the Short Read/Write Size field from u8 to u16, so transfers up to 65535 bytes can be described in one sub-header (driver still caps buffers at 256 bytes).
• obmf-mmio-misc.c and obmf-transport.c updated to match: drop dev_req_tag / mhdr->tag handling, parse the new 2-byte size field.

IO channel tagging:

• The IO channel (type 09h) keeps its own 2-byte sub-header with a Tag byte, so rename the shared struct obmf_channel fields "tag" / "dev_tag" to "io_tag" / "io_dev_tag" to make clear they are IO-only now that MMIO no longer uses tags.
• obmf-transport.c: split the combined MMIO/CONFIG/IO tag-checking and dev-request dispatch paths into a tagged IO path and an untagged MMIO/CONFIG path.

SPI response sub-header (3 bytes, was 4):

• Drop the reserved byte after the command echo; ReadDataSize now starts right after cmd_echo. Introduce OBMF_SPI_RESP_SUBHDR_SIZE and use it everywhere instead of hardcoded offsets.

Discovery / Channel 0 (spec §4.13):

• Register map offsets shift down since DEVICE_ROLE is no longer a global Channel 0 field (it moved to a per-channel field instead); update all OBMF_DISC_* offsets accordingly and drop the global device_role read/log.
• Read each channel's MAX_REQUEST_PAYLOAD_SIZE and MAX_RESPONSE_PAYLOAD_SIZE during discovery and cache them in struct obmf_channel.
• Add CONFIG_STATUS, CHANNEL_STATUS health, and CHANNEL_CONTROL bit definitions used by the new config layout, and bump OBMF_MIN_SPEC_VERSION to v1.0.0.
• Raise the Short Read fast-path threshold from 255 to 256 bytes to match the widened MMIO size field.

IO port range enforcement (obmf-io-misc.c):

• Add support for reading the channel's IO_RANGE_CFG configuration data (transaction types supported + enabled port ranges) from Channel 0 during registration.
• Enforce the configured transaction-type and port-range restrictions in the ioctl path, returning -EOPNOTSUPP / -EPERM for disallowed transactions or ports. If the configuration data is unavailable, fall back to permissive mode (unchanged behavior).

No functional change is intended for I2C, I3C, GPIO, serial, IPMI, or OEM channel payload formats beyond the header adjustments above.

Upstream-Status: Pending [Not submitted to upstream yet]