Fix the processing of AVRCP Rcvd Pass Through messages

The assignment and handling of the optional tAVRC_MSG_PASS.p_pass_data
data buffer pointer was inconsistent:
 - For originating AVRCP packets, it was assigned to osi_getbuf()
   allocated memory.
 - For received AVRCP packets, it was a pointer in the middle of the
   received data buffer.
However, in the common function avrc_pass_msg(), the p_pass_data pointer
was deallocated by osi_freebuf(). This triggered an assert when processing
AVRCP Rcvd Pass Through messages with non-zero Data Length field.

Bug: 26865159
Change-Id: I1b2eb6713636c290caca16e77226c114d99dcb8e