Bluetooth: host: Fix deadlocks with pending TX packet handling

This is a moderate redesign of the pending TX packet handling that
aims to eliminate potential deadlocks between the TX thread and the
system workqueue thread. The main changes are:

 - TX context (bt_conn_tx) is allocated during buffer allocation, i.e.
   not in the TX thread.

 - We don't allocate a TX context unless there's an associated
   callback. When there's no callback simple integer counters are used
   for tracking.

 - The TX thread is no longer responsible for TX callbacks or
   scheduling of TX callbacks. Instead, the callbacks get directly
   scheduled (k_work_submit) from the RX priority thread.

 - CONFIG_BT_CONN_TX_MAX defaults to CONFIG_BT_L2CAP_TX_BUF_COUNT,
   and in most cases wont need changing. The value now only indicates
   how many pending packets with a callback are possible.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>