Bluetooth: Controller: Fix aux scanning with mixed ULL/LLL sched

We should decide on flush immediately vs. from disabled_cb based on
ull_hdr reference count instead of last rxd node - if ull_hdr has
non-zero ref, then done event is still pending and we should flush
from there.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>