Bluetooth: controller: Fix Read Peer RPA Command

There are 2 possible interpretations regarding the address to return in
response to the Read Peer RPA HCI Command:

1) The RPA that the local controller generates to be used in certain
packets it sends
2) The RPA generated and used by the peer device in its packets

We used to return 1) but our interpretation turned out to be incorrect
when reading the HCI test specification, so this commit switches to
returning 2).

Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>