Bluetooth: host: add missing meta data destroy callback

Symptoms were that a disconnect happening when a buffer was enqueued but
not sent resulted in a meta-data memory leak.

This is problematic because it seemed (as per the OP) that it resulted in
the whole host getting locked up when a device sending long L2CAP packets
was prone to disconnect-reconnect cycles (e.g. in a bad RF environment).

Fixes #47649

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>