libcamera: framebuffer: Prevent modifying the number of metadata planes

The number of metadata planes should always match the number of frame
buffer planes. Enforce this by making the vector private and providing
accessor functions.

As this changes the public API, update all in-tree users accordingly.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Jean-Michel Hautbois <jeanmichel.hautbois@ideasonboard.com>
Reviewed-by: Hirokazu Honda <hiroh@chromium.org>

src/cam/camera_session.cpp

@@ -374,9 +374,9 @@ void CameraSession::processRequest(Request *request)
 		     << " bytesused: ";
 
 		unsigned int nplane = 0;
-		for (const FrameMetadata::Plane &plane : metadata.planes) {
+		for (const FrameMetadata::Plane &plane : metadata.planes()) {
 			info << plane.bytesused;
-			if (++nplane < metadata.planes.size())
+			if (++nplane < metadata.planes().size())
 				info << "/";
 		}
 	}

src/cam/file_sink.cpp

@@ -110,7 +110,7 @@ void FileSink::writeBuffer(const Stream *stream, FrameBuffer *buffer)
 
 	for (unsigned int i = 0; i < buffer->planes().size(); ++i) {
 		const FrameBuffer::Plane &plane = buffer->planes()[i];
-		const FrameMetadata::Plane &meta = buffer->metadata().planes[i];
+		const FrameMetadata::Plane &meta = buffer->metadata().planes()[i];
 
 		uint8_t *data = planeData_[&plane];
 		unsigned int length = std::min(meta.bytesused, plane.length);