[dma/rtl] Range limit is off-by-one: effective window is one byte smaller than programmed

### Description

According to the [spec](https://github.com/lowRISC/opentitan/blob/b16f2be75d2f38c62d861208453ed5b81ccf41b0/hw/ip/dma/data/dma.hjson#L300), ENABLED_MEMORY_RANGE_LIMIT is inclusive, i.e., it names the last valid byte. However, the check in RTL:
https://github.com/lowRISC/opentitan/blob/b16f2be75d2f38c62d861208453ed5b81ccf41b0/hw/ip/dma/rtl/dma.sv#L870-L872
makes the limit exclusive. Any transfer whose last byte falls on the limit is rejected, even though the configuration is valid per the spec.

Software can bypass this by program the limit + 1.

Thanks to Vishal Bhogade (@vishalbb-git) for reporting this!

Compare the inclusive ENABLED_MEMORY_RANGE_LIMIT definition in hw/ip/dma/data/dma.hjson at line 300 with the boundary check in hw/ip/dma/rtl/dma.sv at lines 870-872. Trace the transfer-end condition and verify the boundary case where the last byte equals the configured limit. Done means that valid transfers ending at the inclusive limit are accepted without changing the documented configuration semantics.

Written by the indexing model from the issue text.