coolscan3: initialize load/eject/reset parameter blocks

Summary

cs3_load(), cs3_eject(), and cs3_reset() append a 13-byte parameter block after their command bytes, but the backend never initializes that block. The send buffer is reused, so a later command can transmit bytes left by an earlier command as parameters.

This change zeros the 13-byte block after growing the buffer and before issuing each command.

This is an uninitialized-buffer fix. It did not block ordinary scanning or device open in this setup. Film intake is automatic on this adapter, autoload is off, and the working roll path does not send the host load command.

Hardware evidence

Tested with a Nikon Super Coolscan LS-5000 ED, firmware 1.03. Its SA-21 has the solderless SA-30 conversion.

Before the patch, USB debug output showed bytes from an earlier MODE SELECT in the 13-byte block. After the patch, all 13 bytes are zero.

• Mechanical eject worked after the change.
• Reset no longer returned the earlier invalid-command response, although I did not separately characterize every mechanical effect.
• Host load (E0 D1) is still rejected by this firmware even with a clean block. That appears to be a separate protocol question and does not prevent automatic film intake.

Verification

Local branch: coolscan3-init-command-params

Commit: cb493ae9727f3e4eeae2b3a48806c9e33f326ade

• project Linux style check: passed;
• Linux build with warnings treated as errors: passed;
• make check: passed;
• focused .backend news fragment: included;
• upstream pipeline for the merged commit: passed all seven jobs, including make-distcheck.

Related issue: #8