demmt: move pushbuf decode state from decode fragment to buffer

Writes for single command batch can be interrupted by other writes
or ioctls, so this is needed to not lose state.
demmt: add support for old-style commands for >= nvc0 buffers

They are not used by the blob, but this code is needed to signal
there's something fishy going on.
demmt: do not print "subchannel already taken" messages when buffer is known-invalid
demmt: hacky IB trick detection

Blob writes M2MF header, switches to another buffer for M2MF.DATA and then
switches back for next commands, so we incorrectly use those commands
as M2MF.DATA. Without proper IB detection there's not much we can do other
than hacks like this one.

IB support will come later.
demmt: more ioctl message spam