vrend: Use the used mask provided by the shader early when binding images
The image bindings are stored in a dynamic array that is allocated when the shader is compiled. Therefore, if the guest tries to bind images that are not in range we were hitting an OOB access because we checked the shader provided mask late. Instead mask out the extra images up front.
Fixes: https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/511