Bluetooth: Use proper sock reference counting in L2CAP

A socket can be shut down while pointer to that socket is stored in a
queued skbuff or in a pending workqueue struct. Correct use of socket
reference counting will make sure the socket struct stays around until
there are no remaining references.

Change-Id: Ic3679e023a46b224929b3cefb6370d7871e3368a
CRs-fixed: 313736
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>