Make hex_dec do what it claims to, and add TODO to fix unsoundness.

It was converting the address in the string to a reference, which is
definitely not safe. I've moved the unsafety to the caller instead, but
it is still unsound.

Bug: 290018030
Test: atest libbt_common_inline_tests
Change-Id: I412b2152f5f6603f92db0251729988b7f58e112c