SMP: Fix invalid auth_req in LE Security Request handler

Due to wrong pointer de-reference, auth_req value read
in smp_proc_sec_req (LE Security Request packet handler)
was invalid.

Logcat trace shows invalid auth_req value:
.. bt_smp  : smp_proc_sec_req: auth_req=0xf9
   ....
.. bt_smp  : smp_proc_sec_req: auth_req=0xe9

After the fix, auth_req value is correct:
.. bt_smp  : smp_proc_sec_req: auth_req=0x1
   ....
.. bt_smp  : smp_proc_sec_req: auth_req=0x5

This data flow can be traced in code on this path:
smp_data_received -> smp_sm_event -> smp_proc_sec_req

Issue seen after following change:
https://android-review.googlesource.com/c/platform/system/bt/+/492442

Issue was discovered during execution of PTS test
cases GAP/SEC/AUT/BV-13-C and GAP/SEC/AUT/BV-14-C.

Fixes: 122066779

Test: Verified logcat trace shows valid auth_req
value prints from smp_proc_sec_req() function

Change-Id: I072b4794fb56a05b7ac7f2f4ca606514d7524550