Bluetooth: host: gatt: Properly check subscription status

We had two bugs:

- we didn't check the subscription, only the fact that the passed chrc can
be subscribed to.

- that check only worked if we passed the chrc descriptor handle, not its
value handle.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>