Add missing OUT endpoint to USB HID keyboard interface so the host can send LED state reports (CapsLock, NumLock, ScrollLock) to the device. This makes furi_hal_hid_get_led_state() return the actual host LED state instead of always returning 0.

Closes #4162
Closes #4214

What's new

• Added OUT endpoint (host-to-device) to USB HID keyboard descriptor and endpoint configuration
• The HID keyboard previously only declared an IN endpoint, so the host had no way to send LED state OUTPUT reports back to the device
• The callback code to parse LED reports already existed in hid_txrx_ep_callback() but never fired since no OUT endpoint was registered
• Mirrors the pattern already used in furi_hal_usb_u2f.c which correctly declares both IN and OUT endpoints

Verification

1. Flash the firmware to a Flipper Zero, connect it to a computer via USB
2. Open the Bad USB app and run a script that uses NUMLOCK detection — Bad USB calls furi_hal_hid_get_led_state() internally to check NumLock state. Before this fix, that check always returned 0
3. Alternatively, write a simple .fap app that calls furi_hal_hid_get_led_state() after setting up USB HID with furi_hal_usb_set_config(&usb_hid, NULL):
   • Toggle CapsLock from Flipper or physical keyboard
   • Verify furi_hal_hid_get_led_state() returns correct bitmask (0x01=NumLock, 0x02=CapsLock, 0x04=ScrollLock) instead of always 0
4. Verify normal HID keyboard/mouse/consumer key functionality is unaffected

Checklist (For Reviewer)

• PR has description of feature/bug or link to Confluence/Jira task
• Description contains actions to verify feature/bugfix
• I've built this code, uploaded it to the device and verified feature/bugfix