Bluetooth: SSP: `bt_conn_unref` is missing if pairing is not accepted

The `conn` is found by using function `bt_conn_lookup_addr_br()`, it
should be released by calling `bt_conn_unref()`. But `bt_conn_unref()`
is missing in the case that the pairing is not accepted.

Release the `conn` by calling `bt_conn_unref()` before exiting the
function `bt_hci_io_capa_req`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>