[speech] unbind from recognition service

Currently, we only remove the service reference, but rely on the timeout
built into `ServiceConnector` to actually unbind. This is causing a
service leak.

We also move `SpeechRecognizer#destroy()` to be handled on the Handler
(just like all other calls) in order to fix racing.

Bug: 313604307
Bug: 311124261
Test: cts

Change-Id: I5384916da98b286f869a32857079087105ca32f9