Bluetooth: Fix HCI channel reference counting

When an incoming HCI logical link event came in at the same time
a socket structure was deleted, it was possible to end up with a stale
pointer to the socket.  The socket and associated HCI channel struct
need to be properly reference counted so they are not freed
prematurely.

CRs-Fixed: 325023
Change-Id: Ia5724a9ce2000acd60a174c354be04029bac5324
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>