rp2040/hcd: abort EPX transfers and release the buffer of a failed one (#4166)

The usbh control watchdog (#3862) relies on hcd_edpt_abort_xfer(), which was
a stub here: a timed-out transfer stayed live on EPX, the round-robin resumed
it later, and its RX timeout left epx_buf_ctrl AVAILABLE, so the next transfer
panicked "buf_ctrl already available". A STALLed control IN leaves it the same
way. Abort and device close (dev0 included) now stop the SIE and release EPX,
and a STALL or RX timeout releases the buffer and its pending BUFF_STATUS.

Fixes #4108, fixes #3874.