The format command accepted any 32-bit value for -m, -p, -l and
--ses and passed it into the Format NVM command. Before
eae727676169 an out-of-range value spilled into the adjacent cdw10
fields, which usually drew an error from the controller; after it,
the value is masked to the field width, so a mistyped value is
silently accepted with a different meaning. Most seriously,
--ses 8 masked to SES=0 and performed a plain format with no erase
at all, exiting 0. A value like --ses 10 masked to a cryptographic
erase while bypassing the FNA cryptographic erase capability check,
which compares the unmasked value.

Reject values outside the ranges nvmecontrol.8 documents, which are
the values the spec defines: 0-1 for -m and -l, 0-3 for -p, and
0-2 for --ses. The checks run at option validation time, before
the device is opened, and the capability check now only ever sees
valid values.

While here, document --ses in nvmecontrol.8; it was missing from the
format subcommand's option list.

Reported by: llm-postcr
Fixes: eae727676169
MFC after: 1 week
Sponsored by: Spectra Logic
Assisted-by: Claude Fable 5 <noreply@anthropic.com>