lib9p: Remove potential buffer overwrite in l9p_puqids()

Structure l9p_f_wralk reserves at most L9P_MAX_WELEM entries
and that number actually set the maximum we can safely use.

Approved by: so
Security: FreeBSD-SA-22:12.lib9p
PR: 265385
Reviewed by: markj

(cherry picked from commit 2dd83b3f0507fc7bc64b908fb88f285a3b9663c8)
(cherry picked from commit c536045c51da78a85138e963d3b7e13a547713c9)