Bluetooth: host: fix incorrect ISO HCI fragmentation logic

Don't push the TS flag on `buf` itself.

This messes up the MTU calculations: a packet that would exactly fit the
MTU and has a timestamp would be unnecessarily fragmented.

The MTU check is done on `buf` as a whole. At the point where the
fragmentation length is decided, `buf` includes one extra byte to pass the
TS bit around. That byte shouldn't count towards the MTU.

Instead, infer the presence of the timestamp by inspecting the amount of
headroom that the buffer has. This works because we always reserve
enough memory to push the timestamp, but not always push a timestamp on
the buffer. #tightlycoupled

This method is slightly uglier IMO, but eases MTU confusion and doesn't
rely on user_data.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>