Use the H2C endpoint for sending firmware commands, rather than the voice
data queues.

This is similar to the openbsd and rtlwifi/r92su drivers.

Note: this driver still assumes it's a 4-endpoint device; I'll enforce
that in a follow-up commit.