Various iwn(4) fixes.

• simplify channel logic for determining RF gain setting in scan setup
• don't set TX timer on error
• free node references for unsent frames on device stop
• set maxfrags to IWN_MAX_SCATTER-1 (first segment is used by TX command)
• add missing IWN_UNLOCK() from interrupt path when the hardware disappears.
• pass control frames to host
• nitems() instead of local macro

Tested:

• Intel 5100, STA mode

PR: kern/196264
Submitted by: Andriy Voskoboinyk <s3erios@gmail.com>