Bluetooth: SSP: Reply a negative rsp if binding flags are mismatched

If the remote is in bondable mode, but the local is in non-bondable
mode, the local host shall respond to an IO capability request with
a negative response.

In current implementation, it does not check the bonding flags of the
both sides are consistent.

Fix the issue by checking the consistency of bonding flags of the both
sides. If they are not consistent, send a negative IO capability
response with the reason pairing not allowed.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>