nimble/host: inherit characteristic security requirements in CCCD

[gmarull]

The CCCD was registered with plain read/write permissions regardless of the security declared on its characteristic, so any unencrypted client could subscribe and receive an otherwise protected value via notifications/indications, bypassing its protection.

The Core Specification leaves CCCD write permissions to the implementation and anticipates gating them (Vol 3, Part G, 3.3.3.3; Vol 3, Part F, 3.2.5). Zephyr already enforces this: the CCC carries its own security permissions, and the value's read security is checked in the notify/indicate send path. NimBLE auto-generates the CCCD with no per-descriptor permission API, so inherit the characteristic's security requirements to achieve the same protection.

Require for the CCCD write the union of the characteristic's read and write encryption/authentication flags, derived via ble_gatts_att_flags_from_chr_flags to keep a single mapping point, and propagate min_key_size as well. Authorization flags are deliberately not inherited: ble_att_svr_check_perms does not enforce authorization (left to the access callback, which for the CCCD is stack-internal), and the flag alone would activate the min_key_size check, rejecting every CCCD write on an unencrypted link. CCCD reads remain unprotected, per Vol 3, Part G, 3.3.3.3.

[sjanc]

I think this is reasonable approach (but please fix style reported)

[gmarull]

I think this is reasonable approach (but please fix style reported)

Thanks, fixed style