Bluetooth: ATT: Fix not restoring buffer state when send fails

Since bt_l2cap_send_cb can fail returning its error is not enough as
the buffer has been modified to add the headers, so this save the state
before calling bt_conn_send_cb and takes a reference so it can be
restored its original state in case of error.

Fixes #27434

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>