Fix 7 logic bugs found by security audit in lib_nbgl

nbgl_layout.c: wrong variable in HEADER_EXTENDED_BACK action button color
  button->foregroundColor written instead of actionButton->foregroundColor;
  back button color overwritten, action button foreground stayed at 0.

nbgl_layout.c: OOB write in header container children pool allocation
  When separationLine=true and subText!=NULL in HEADER_EXTENDED_BACK, up
  to 6 children written into a 5-slot allocation, corrupting objContainerPool.

nbgl_use_case.c: uninitialized previousHeight in GetNbInfosInPage,
  GetNbBarsInPage, GetNbChoicesInPage
  Missing = 0 (present in sibling GetNbSwitchesInPage). On first-item
  overflow, stale value triggers nbItems-- underflow to 255, cascading
  into OOB write in genericContextPagesInfo[].

nbgl_layout_keyboard.c: deprecated nbgl_layoutUpdateEnteredText using
  stale child indices after addTextEntry() two-level container refactor
  Was accessing mainContainer->children[2] (wrong level and index) for
  the text area, and layoutInt->container->children[1] for the number
  area (now the button/suggestions slot).

nbgl_layout_keyboard.c: NULL returns from addTextEntry,
  addSuggestionButtons, addConfirmationButton not checked
  Three call sites used the return value directly without a NULL check;
  NULL dereference in production where LOG_FATAL is a no-op.

nbgl_use_case.c: unbounded modal page count in displayTagValueListModal
  No upper bound on detailsContext.nbPages; a list with enough alias
  pairs to exceed 32 pages writes past modalContextPagesInfo[].

nbgl_layout.c: missing NULL guards for callback and pair in
  nbgl_layoutAddTagValueList
  Callback invoked without NULL check when pairs==NULL; return value not
  checked; pair->extension dereferenced without NULL guard at two sites.