erp: Fix off by one error

The intent of this check is to make sure that at least 2 bytes are
available for reading.  However, the unintended consequence is that tags
with a zero length at the end of input would be rejected.

While here, rework the check to be more resistant to potential
overflow conditions.

src/erp.c

@@ -117,7 +117,7 @@ static bool erp_tlv_iter_next(struct erp_tlv_iter *iter)
 	unsigned int tag;
 	unsigned int len;
 
-	if (iter->pos + 2 >= iter->max)
+	if (end - tlv < 2)
 		return false;
 
 	tag = *tlv++;