net80211: correct length check in ieee80211_ies_expand()

In ieee80211_ies_expand() we are looping over Elements
(also known as Information Elements or IEs).
The comment suggests that we assume well-formedness of
the IEs themselves.
Checking the buffer length being least 2 (1 byte Element ID and
1 byte Length fields) rather than just 1 before accessing ie[1]
is still good practise and can prevent and out-of-bounds read in
case the input is not behaving according to the comment.

Reported by:	(coypu sdf.org)
admbugs:	857
MFC after:	3 days
Reviewed by:	adrian, markj
Differential Revision: https://reviews.freebsd.org/D32340

sys/net80211/ieee80211_node.c

@@ -1133,7 +1133,7 @@ ieee80211_ies_expand(struct ieee80211_ies *ies)
 
 	ie = ies->data;
 	ielen = ies->len;
-	while (ielen > 0) {
+	while (ielen > 1) {
 		switch (ie[0]) {
 		case IEEE80211_ELEMID_VENDOR:
 			if (iswpaoui(ie))