Update `SPDM_MAX_VENDOR_ID_LENGTH` to be more precise

[steven-bellock]

From #3325 (comment) and https://github.com/DMTF/SPDM-WG/issues/4396.

SPDM_MAX_VENDOR_ID_LENGTH is currently set to 255, due to IANA CBOR. This is a bit lazy, and the value can be reduced. The maximum size is nine bytes for a CBOR-encoded tag number.