SmbusNCT6793: validate transfers before the reset and fail timeouts

The address, direction and command went to the controller unchecked, and
the soft reset happened before any of them were looked at, so a request
that was going to be rejected still disturbed whatever the controller was
doing. An out of range address aliased another slave and a direction
other than 0 or 1 corrupted the address byte. The block length and the
unsupported block read are now rejected before the reset too, rather than
partway through programming the transfer.

Both timeout paths returned STATUS_TIMEOUT, which is success severity, so
NT_SUCCESS() treated a timed out transfer as a completed one, and they
left the controller in manual mode. They now reset it and return
STATUS_IO_TIMEOUT.

The IOCTL keeps its fixed 9 in / 5 out shape, matching the other SMBus
modules, even though this controller has no block read.