l2cap: Fix Le Coc payload length checking

Accroding to Bluetooth Core 5.2 | Vol 3, Part A, 3.4.3.
In LE Coc flow control modes, receiver shall disconnect L2CAP channel when
1. SDU length field value exceeds the receiver's MTU
2. the payload length of any K-frame exceeds the receiver's MPS
3. the sum of the payload lengths for the K-frames exceeds the specified SDU length

Bug: 237503065
Bug: 235195694
Tag: #feature
Test: PTS L2CAP/LE/CFC/BV-26, 27, 28
Change-Id: Ibaac8ec414a53a7c9f31d2f506a851d4fe1f00ab