parser: 5-node count for bsimbulk/bsimcmg_va in model_numnodes

Without this entry, OSDI BSIM-BULK / BSIM-CMG models fall through
to model_numnodes()'s default 'return 4'.  The two consumers in
INP2M() (the 'too many nodes' check and the node-binding loop)
then set up only 4 GENnode slots on the instance.  The OSDI
runtime's node_mapping[] reads its 5-port descriptor and picks
up a stale/wrong node index for port 5 — effectively rewiring
the body (or temperature) terminal to a random node.

Symptom: PMOS body diode forward-biased through the supply.
A simple CMOS inverter draws amperes in steady state and fails
to switch rail-to-rail.  This branch demonstrates the bug
(without this commit) and the fix (with it).

Also add bsimcmg_va to the model-type allowlist in INP2M() for
consistency with bsimbulk (which was added in the previous
commit).

src/spicelib/parser/inp2m.c

@@ -31,6 +31,12 @@ model_numnodes(int type)
         return 6;
     }
 
+    if (type == INPtypelook("bsimbulk") ||      /* 5 ; (d,g,s,b,t) */
+        type == INPtypelook("bsimcmg_va"))      /* 5 ; (d,g,s,e,t) */
+    {
+        return 5;
+    }
+
     if (type == INPtypelook("VDMOS"))       /* 3 ; VDMOSnames */
     {
         return 5;
@@ -138,7 +144,8 @@ INP2M(CKTcircuit *ckt, INPtables *tab, struct card *current)
         thismodel->INPmodType != INPtypelook("HiSIMHV1") &&
         thismodel->INPmodType != INPtypelook("HiSIMHV2") &&
         thismodel->INPmodType != INPtypelook("VDMOS") &&
-        thismodel->INPmodType != INPtypelook("bsimbulk"))
+        thismodel->INPmodType != INPtypelook("bsimbulk") &&
+        thismodel->INPmodType != INPtypelook("bsimcmg_va"))
     {
         LITERR ("incorrect model type");
         return;