Bluetooth: Move canceling security_timer into smp_chan_destroy()