Bluetooth: host: Fix unsafe cast in is_subscribed

The current implementation casts the user data to the attribute value,
which makes an assumption about the user data. This commit changes the
implementation to use the attribute value read function when extracting
the characteristic properties.

Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>