qxl: fix range check for rev3 io commands. Enables QXL_IO_FLUSH_SURFACES_ASYNC and QXL_IO_FLUSH_RELEASE which are part of the qxl rev3 feature set. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>