bluetooth: l2cap: validate alloc_buf user data

validate the assumptions about buffers returned by alloc_buf() in the
LE CoC receive path.

if the returned buffer does not provide enough user_data space for the
internal segment counter, disconnect and drop the buffer instead of
reading or writing past the metadata area.

also document that alloc_buf() must return a buffer with at least
sizeof(uint16_t) bytes of user_data.

Signed-off-by: Oleh Konko <security@1seal.org>
(cherry picked from commit 09ad7174e940fde3bdd2e24214ca249c12a41cb8)