fix buffer overread in get_feature_data

l2cap_send was passed the caller's `len` (expected response size) instead of
the actual array size. The get_feature array is only 2 bytes (transaction
header + report ID), so this read up to 62 bytes of uninitialized stack.

Use sizeof(get_feature) to send only the 2-byte GET_REPORT request.

src/bt.cpp

@@ -487,7 +487,7 @@ vector<uint8_t> get_feature_data(uint8_t reportId, uint16_t len) {
     if (!feature_data.contains(reportId) || reportId == 0x81) {
         if (hid_control_cid != 0) {
             uint8_t get_feature[] = {0x43, reportId};
-            l2cap_send(hid_control_cid, get_feature, len);
+            l2cap_send(hid_control_cid, get_feature, sizeof(get_feature));
             printf("[L2CAP] Requesting Get Feature Report 0x%02X\n", reportId);
         }
     }