Bluetooth: L2CAP: Mark user_data as owned by the stack

Storing stuff in user_data? That's a paddlin'

We have been debugging issue after issue because ownership of this
"user" data is not clearly defined. Now it is. L2CAP owns the user_data
field entirely, as soon as `send()` is called.

Also add a warning and retval using CHECKIF.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
(cherry picked from commit ea944997)