Bluetooth: att: allocate RSP buffer from same channel as REQ

Using a different channel for responding to a request is forbidden by spec.

The allocator was especially flawed as it iterated over all the EATT
channels to find one w/ a big enough MTU, but the sending was still done
over the same channel as the REQ.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>