iwlwifi: mvm: change scan timeout to a delayed work

Some transports may sleep when writing to registers, which is done
when calling iwl_force_nmi().  So we can't call iwl_force_nmi() in a
timer context.  To solve that, convert the scan timeout timer to a
delayed work.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>