Bluetooth: Host: Make tx complete callback work for EATT channels

Previously, if a callback was set for notifications, they would always be
sent over unenhanced ATT.

The nfy_mult_data was bigger than the buffer user_data and we were this
overflowing the buffer when setting the tx callback user_data. Now the
data is stored separately and only a pointer to it is added to the
buffer user_data.

Signed-off-by: Herman Berget <herman.berget@nordicsemi.no>