net: sockets: tls: Advance a held back message during poll prepare

A datagram can carry more than one DTLS record. Mbed TLS reads the whole
datagram into its input buffer and processes one record at a time, so
once the application has consumed the first record the socket has no
readiness left to report while a complete record is still held by Mbed
TLS. A poll that waits on that socket alone then sleeps until an
unrelated datagram arrives.

Query mbedtls_ssl_check_pending() during poll prepare and, only when it
reports an unprocessed message, advance it with one nonblocking data
check. Guarding on check_pending() keeps poll free of a recvfrom() on
the underlying socket in the common case, which matters for offloaded
stacks where that is a round trip to the modem.

A data check can also report a peer close or a fatal error. Neither is
visible to the underlying socket, so latch the error and report the
latched state as POLLHUP or POLLERR from poll update instead of
discarding it.

Assisted-by: Claude:Opus-5
Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>