drivers: ieee802154: fix freeing Rx buffer

This commit fixes a bug where an already received Rx frame could not be
processed by the IEEE 802.15.4 driver.

In the current implementation, buffer is marked as free and released to
the buffer pool after `nrf_802154_buffer_free_raw` finishes executing.
However, delays caused by thread scheduling might result in a new frame
being already received and provided to the driver before
`nrf_802154_buffer_free_raw` returns. Such a situation ends in an
assertion now.

This commit changes that behavior by marking the buffer as free before
calling `nrf_802154_buffer_free_raw`.

Signed-off-by: Jedrzej Ciupis <jedrzej.ciupis@nordicsemi.no>
diff --git a/drivers/ieee802154/ieee802154_nrf5.c b/drivers/ieee802154/ieee802154_nrf5.c
index c328ba2..e31a993 100644
--- a/drivers/ieee802154/ieee802154_nrf5.c
+++ b/drivers/ieee802154/ieee802154_nrf5.c
@@ -127,6 +127,7 @@
 	struct net_pkt *pkt;
 	struct nrf5_802154_rx_frame *rx_frame;
 	uint8_t pkt_len;
+	uint8_t *psdu;
 
 	ARG_UNUSED(arg2);
 	ARG_UNUSED(arg3);
@@ -190,8 +191,9 @@
 			goto drop;
 		}
 
-		nrf_802154_buffer_free_raw(rx_frame->psdu);
+		psdu = rx_frame->psdu;
 		rx_frame->psdu = NULL;
+		nrf_802154_buffer_free_raw(psdu);
 
 		if (LOG_LEVEL >= LOG_LEVEL_DBG) {
 			log_stack_usage(&nrf5_radio->rx_thread);
@@ -200,8 +202,9 @@
 		continue;
 
 drop:
-		nrf_802154_buffer_free_raw(rx_frame->psdu);
+		psdu = rx_frame->psdu;
 		rx_frame->psdu = NULL;
+		nrf_802154_buffer_free_raw(psdu);
 
 		net_pkt_unref(pkt);
 	}