Bluetooth: Mesh: Fix canceled buffer memory leak

In case a queued buffer is canceled before sending we have to unref
it, since that's what adv_send() would do as well.

Fixes #17936
Fixes #18013

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>