pjproject: fixed a few bugs

This patch fixes the issue in pjsip_tx_data_dec_ref()
when tx_data_destroy can be called more than once,
and checks if invalid value (e.g. NULL) is passed to.

This patch updates array limit checks and docs
in pjsip_evsub_register_pkg() and pjsip_endpt_add_capability().

Change-Id: I4c7a132b9664afaecbd6bf5ea4c951e43e273e40