ath10k: fix nullfunc workaround

The workaround couldn't work correctly because the
802.11 header wasn't properly stripped of QoS Data
bit so it wasn't recognized in the later parts of
tx path as NullFunc frame and ended up in HTT Tx
instead of HTT Mgmt Tx.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>