Bluetooth: Host: Fix `SYS_SLIST_FOR_EACH_NODE_SAFE` misuse

In `gatt_write_ccc_rsp`, the third field of
`SYS_SLIST_FOR_EACH_NODE_SAFE` was use as the `prev` sys_node when
calling `gatt_sub_remove`. This was wrong because the third field of
`SYS_SLIST_FOR_EACH_NODE_SAFE` is actually the next node.

Fix the issue by adding a pointer to the previous node and passing it to
`gatt_sub_remove`.

Signed-off-by: Théo Battrel <theo.battrel@nordicsemi.no>