usbd: keep RX_PENDING until the class consumes, not just through xfer_cb

The whole point of the bit is that claim() fails until the buffer is consumed.
Releasing it after xfer_cb returns reopened the #1292 window for a class that
hands the buffer to the application and re-arms from another task later. Every
in-tree OUT path consumes or re-arms via usbd_edpt_xfer, which clears the bit.