CVE-2026-31394: mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations

In the Linux kernel, the following vulnerability has been resolved:

mac80211: fix crash in ieee80211chanbwchange for APVLAN stations

ieee80211chanbwchange() iterates all stations and accesses link->reserved.oper via sta->sdata->link[linkid]. For stations on APVLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in ieee80211stacaprxbw() when accessing chandef->chan->band during CSA.

Resolve the VLAN sdata to its parent AP sdata using getbsssdata() before accessing link data.

[also change sta->sdata in ARRAYSIZE even if it doesn't matter]