Implement userspace-driven device heap expansion for the AMDXDNA
accelerator driver. Instead of allocating a single large heap upfront,
the heap starts with a single 64MB chunk and grows on demand when
device BO allocations fail with -EAGAIN, signaling userspace shim to
expand the heap and retry.

The heap is managed as a linked list of chunks per client, tracked by
client->dev_heap_chunks. A drm_mm allocator spans the full max heap
address range, with allocations constrained to committed chunks via
drm_mm_insert_node_in_range. Each chunk is a shmem-backed GEM object
with its kva lazily vmapped for CPU access. DEV BO kernel address
resolution walks the chunk list to locate the containing chunk.

Per-hwctx heap pinning uses all-or-nothing semantics: map_heap pins
every committed chunk and notifies firmware (map_host_buf for the
first, add_host_buf for subsequent chunks). On failure, all chunks
pinned for that hwctx are rolled back. The heap_pinned flag tracks
whether a hwctx has successfully pinned the heap. New chunks are
broadcast to existing hwctxs via hwctx_heap_expand.

For PASID mode, a lazy UVA computation derives each chunk's expected
user virtual address from the first chunk's UVA plus preceding chunk
sizes, since userspace reserves a contiguous VA range for the entire
heap.

Key changes:
- amdxdna_gem.c: Add chunk list management, drm_mm-based allocation
  with -EAGAIN expansion, early handle creation in
  amdxdna_drm_create_dev_heap_bo, DEV BO kva resolution across
  chunks, lazy UVA computation for PASID mode, and chunk-aware
  sync BO cache flush.
- aie2_ctx.c: Add per-hwctx heap pin/unpin with all-or-nothing
  rollback (aie2_hwctx_map_heap / aie2_hwctx_release_heap),
  firmware heap mapping, and heap expansion notification
  (aie2_hwctx_heap_expand).
- aie2_message.c: Refactor aie2_map_host_buf to send per-chunk
  messages, add aie2_add_host_buf for heap expansion.
- npu*_regs.c: Add max heap size device info fields. NPU1 retains
  single-chunk (64MB) limit; NPU4+ support up to 512MB.

Signed-off-by: Wendy Liang <wendy.liang@amd.com>

Add bounds checking for user-supplied offset and length parameters in
amdxdna_gem_dev_bo_clflush() before computing flush range. Without
this, out-of-range values could cause cache flush operations on
unrelated kernel memory.

Signed-off-by: Wendy Liang <wendy.liang@amd.com>