Two related fixes to aq(4)'s RSS indirection table handling:

1. Fix an out-of-bounds stack write in aq_hw_rss_set(). RSS table entries are 3 bits (8 queues max), but with more than 8 RX rings rss_table[] holds larger values; the 32-bit write then spills one uint16_t past bitary[] and corrupts the stack, so the NIC never links or the kernel panics. Mask each value to 3 bits and pack 16 bits at a time to keep the write in bounds.

2. Build the indirection table in aq_if_attach_post() with a modulo over min(rx_rings_count, HW_ATL_RSS_INDIRECTION_QUEUES_MAX) instead of i & (rx_rings_count - 1), which assumed a power-of-two ring count.

Confirmed on AQC107 (firmware 3.1.88) under FreeBSD 15.0-RELEASE: with the OOB write the interface attached but stayed "no carrier"; with the fix the link negotiates 1000baseT full-duplex and passes traffic.