Bluetooth: GATT: Fix not removing subscriptions safely

The subscriptions callback may free or reuse the subscription so all
instances that where this could happen need to safely fetch the next
element which is why this changes switch to use sys_list_t as it has
SYS_SLIST_FOR_EACH_NODE_SAFE.

Change-Id: I37d51f27116ea0c057b560924a9416676477597b
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>