bluetooth: host: fix connection reference before returning

As the connection was removed from the list, we now own its reference.
Keep this reference and return it to the TX processor.

Signed-off-by: Ahmed Ahmed <ahmed.ahmed@dewinelabs.com>