Bluetooth: Call L2CAP teardown callback before clearing chan->conn