Fix SDL3 gamepad crash, broken motion, and thread safety issues

- Remove SDL_DestroyProperties call on SDL-owned properties in
  SDL3Gamepad.GetFeaturesFlag(). SDL_GetGamepadProperties returns
  properties owned internally by SDL, freed when SDL_CloseGamepad is
  called. Destroying them causes use-after-free, breaking motion sensor
  data retrieval and crashing on controller reconnect.

- Fix GetGamepads() using wrong lock objects (_gamepadsIds, _joyConsIds,
  _linkedJoyConsIds instead of _lock) and holding locks across yield
  boundaries, which is incompatible with System.Threading.Lock. Snapshot
  IDs under _lock and iterate outside it.

- Add null-conditional to _gamepad.Rumble() in NpadController.UpdateRumble()
  to prevent NullReferenceException if gamepad is disconnected mid-update.

src/Ryujinx.Input.SDL3/SDL3Gamepad.cs

@@ -151,7 +151,9 @@ namespace Ryujinx.Input.SDL3
                 result |= GamepadFeaturesFlag.Led;
             }
             SDL_UnlockProperties(propID);
-            SDL_DestroyProperties(propID);
+
+            // NOTE: Do not call SDL_DestroyProperties here. These properties are owned
+            // internally by SDL and are freed when SDL_CloseGamepad is called (in Dispose).
 
             return result;
         }