nrf70: Fix RX buffer rollback on host refill failure

Raw scan disables mgmt buffer offload, so the host must refill every RX descriptor. If hal_data_cmd_send fails after mapping, the buffer stayed marked mapped and the nbuf leaked. Repeated scans eventually exhaust RX slots and the firmware scan stalls mid-channel.

Free and unmap on failure so the descriptor can be re-initialized.