Fix HID get_report callback support

There were multiple bugs in the code for get_report event
callback handling:

1) the p_dev lookup was using the wrong argument so was coming
   up with NULL ptr and passing it through to the callback

2) the BT_HDR * was being passed to the callback instead of a
   ptr to the payload

3) the size was being passed as a constant BT_HDR_SIZE.

It looked like this code was expecting the callback to parse
the BT_HDR, but that's an internal bluedroid structure.
The callback is defined as receiving the report data and the
report data size, which this change now provides.

Note that the payload might be NULL if the device returns
a HANDSHAKE error msg instead, and so it is valid to pass
the callback a NULL payload ptr and a 0 size.

Change-Id: I462b5cb5d4c460af085dc6e15f59c778a020a80e
Signed-off-by: Mike J. Chen <mjchen@google.com>