Bluetooth: Host: Fix `bt_l2cap_chan_ops.recv` `-EINPROGRESS`

Fix discrepancy in reference management between calls to
`bt_l2cap_chan_ops.recv` when the application returns `-EINPROGRESS`.

There are two call sites, `l2cap_chan_le_recv_sdu` and
`l2cap_chan_le_recv`, that were inconsistent.

`l2cap_chan_le_recv_sdu` moves the reference, and this patch updates
`l2cap_chan_le_recv` to do the same.

This behavior is also now documented.

This bug has existed since the introduction of this feature in
3151d265.

Signed-off-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>