net80211: split up ieee80211_probereq()

Factor out ieee80211_probereq_ie() and ieee80211_probereq_ie_len()
and make the length dynamic rather than static max. The latter is
needed as our current fixed length was longer than some "hw scan",
e.g. that of ath10k, will take. This way we can pass what we have.
Should this not be sufficient in the future we might have to deal
with filtering and much more error handling.

This also removes a duplicate calculation for ieee80211_ie_wpa [1].

c338cf2c6d5eacdee813191d5976aa531d450ee7 split up ieee80211_probereq_ie().
For HW scans we usually do not want to add a SSID to the IEs.
During that split we allocate memory based on the length which will
always include the length of the SSID and only later we reduced the
length but never updated the value passed back to the caller.
Split the SSID handling up and reduce the length before malloc().
This not only makes us not over-allocate in these situatoins but also
fixes the length returned to the caller and with that usually directly
passed to firmware.

Repoprted by: Martin Husemann <martin NetBSD.org> [1]
Sponsored by: Rubicon Communications, LLC ("Netgate")
Sponsored by: The FreeBSD Foundation (update for alloc)
Reviewed by: adrian, martin NetBSD.org (earlier version)
Reviewed by: philip
Differential Revision: https://reviews.freebsd.org/D26545
Differential Revision: https://reviews.freebsd.org/D30813

(cherry picked from commit c338cf2c6d5eacdee813191d5976aa531d450ee7)
(cherry picked from commit 243b95978debac3db06df6d26ca9f8d84f6cbd83)