fix bt_hc_worker_thread() sometimes transmit more than num_hci_cmd_pkts

fix bt_hc_worker_thread() sometimes transmit more than num_hci_cmd_pkts

bt_hc_worker_thread() checks the controller's outstanding HCI
command credits (maintained in num_hci_cmd_pkts) and skips the rest
of the tx queue after it has used up the credits. But the skip
condition is not correct in the loop:

      if ((tx_cmd_pkts_pending == TRUE) || (num_hci_cmd_pkts <= 0))
      {
          tx_cmd_pkts_pending = TRUE;
          // skip the rest of the packets in the tx queue
          ...
      }

Since num_hci_cmd_pkts doesn't change during the loop, this condition
never becomes true. As a result, all the HCI commands in the tx queue
are sent if num_hci_cmd_pkts > 0. That is why sometimes more than
num_hck_cmd_pkts are sent.

To check a correct skip condition, we should count how many HCI
command packets are being sent:

      if ((tx_cmd_pkts_pending == TRUE) ||
          (sending_hci_cmd_pkts_count >= num_hci_cmd_pkts))

sending_hci_cmd_pkts_count is incremented every time a HCI command is
pushed for sending. It should never go beyond num_hci_cmd_pkts.

Change-Id: I58101b2785fc3ab4171cdf22497ca97a3ae3124a
Signed-off-by: Toshi Kikuchi <toshik@google.com>