Bluetooth: Controller: df: Possible memory overwrite if requested number of CTE is greater than allowed by configuration

[ppryga-nordic]

Describe the bug

Maximum number of CTE to be send in a periodic advertising chain is
limited by BT 5.3 Vol 4 Part E, section 7.8.80 and is 16.
Maximum number of samples CTE in a periodic advertising chain is
limited by BT 5.3 Vol 4 Part E, section 7.8.82 and is also 16.
Both values are limited by amount of memory reserved in Controller
by Kcofigs, respectfully: CONFIG_BT_CTLR_DF_PER_ADV_CTE_NUM_MAX and
CONFIG_BT_CTLR_DF_PER_SCAN_CTE_NUM_MAX.

Functions ll_df_set_cl_cte_tx_params and ll_df_set_cl_iq_sampling_enable
check limits against Bluetooth specification provided values.
That can end with memory overwrite if number of requested CTEs is
greater that number provided in configuration.

To Reproduce
Steps to reproduce the behavior:

1. Use direction_finging_connectionless_tx sample.
2. Set CONFIG_BT_CTLR_DF_PER_ADV_CTE_NUM_MAX to value smaller than 16.
3. Change code of the sample to request more than CONFIG_BT_CTLR_DF_PER_ADV_CTE_NUM_MAX CTEs.
4. The bt_df_set_adv_cte_tx_param returns with success.

Expected behavior
No memory overwrite.
If Host requests more CTE than allowed by configuration, Controller responses with invalid parameter status.

Impact
Medium, related to code that uses direction finding only.