Bluetooth: Host: Fix ATT security vulnerabilities

When the client receives att error rsp, but the error code
is an illegal value, such as 0, an exception will be triggered.

gatt_read_type --> gatt_read_type_rsp --> parse_characteristic

`switch (rsp->len) {` null address access.

Signed-off-by: Lingao Meng <menglingao@xiaomi.com>