HFP: Fix null pointer dereference in bta_ag_codec_negotiate().

BTM_ReadRemoteFeatures function will return NULL if ACL link to the remote
device is disconnected. Need to check whether p_rem_feat is nullptr
before dereferencing it.

Bug: 129736080
Test: make, force BTM_ReadRemoteFeatures() to return null and perform
MT/MO call tests.

Change-Id: I28d90823340d8721ee2349d3f55f07d1e823fee3
Merged-In: I28d90823340d8721ee2349d3f55f07d1e823fee3