Bluetooth: ATT: call-back on buffer destroy

This is just as arbitrary as what was before, but simpler.

Before this change, the callback were invoked upon receiving the num
complete packets event.
This did not necessarily work with all spec-compliant controllers.

Now the callback is invoked as soon as the lower layer destroys the
buffer. ATT shouldn't care whether L2CAP sends it over RFC1149 or
something else after that point.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
Co-authored-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>