add new usbd_do_request_len() that can allocate a larger than
request size buffer.  reimplement usbd_do_request_flags() in
terms of this.  use this for fetching string descriptors.

fixes a very strange problem where an axe(4) attaching (either
has ugen(4) or axe(4)) would ask for 2 bytes, usb_mem.c would
allocate a 2 byte fragment, perform the operation, and sometime
shortly afterwards (usually by the time the next allocation
is made for this fragment), would become corrupted (usually
two bytes were written with 0x0304.)

(initial request of 4 bytes also avoids the problem on this
device.  it really seems like a HC problem -- host should not
allow the device to write more than req.wLength!  nor should
it allow this write to happen after completion.)

avoid an (almost) always double-log in usbd_transfer().

(mrg)