Bluetooth: Mesh: Fix passing CID to model publication messages

The vendor variants of the model publication client messages were not
passing onward the CID, rather passing CID_NVAL which is clearly not
right.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>