Bluetooth: Host: Clean up buffer user data in case of error

`bt_l2cap_chan_send_cb()` overwrote the buffer user data for internal
use. In the case where sending fails, this would be visible for the
caller. If the caller relied on the buffer user data to be unchanged,
this could cause unexpected behavior.

L2CAP tx metadata was also not freed in the error case.

Signed-off-by: Herman Berget <herman.berget@nordicsemi.no>