Fix type confusion in avdt_msg.cc

It is possible for a malicious user to reply to a pending AVDT message
with the wrong type, leading to type confusion and an eventual OOB
access.

Add message type validation.

Bug: 273995284
Bug: 358212054
Flag: com.android.bluetooth.flags.btsec_avdt_msg_ind_type_confusion
Test: m libbluetooth
Ignore-AOSP-First: security
Tag: #security
Change-Id: Iea207e7e5e3d469ccbc81f5abf945723cf7b60d3