input: fix out of bound read/write in pad_buttons_pressed

When buttons > MP_MAX_TABLET_PAD_BUTTONS and the value is stored in
ictx->tablet_pad_buttons, the next mp_input_set_tablet_pad_focus call
will cause out of bound write, and mp_property_tablet_pos will cause
out of bound read.

Fix this by limiting ictx->tablet_pad_buttons range.

Fixes: 0fbf20f057

input/input.c

@@ -1179,7 +1179,7 @@ void mp_input_set_tablet_pad_focus(struct input_ctx *ictx, bool focus, int butto
         for (int i = 0; i < ictx->tablet_pad_buttons; i++)
             ictx->tablet_pad_buttons_pressed[i] = false;
     }
-    ictx->tablet_pad_buttons = buttons;
+    ictx->tablet_pad_buttons = MPMIN(buttons, MP_MAX_TABLET_PAD_BUTTONS);
     notify_tablet_update(ictx);
     input_unlock(ictx);
 }