net80211: wakeup scan_start() task when null data frame was actually
transmitted

• Use M_TXCB mechanism to report about null data frame transmission.
• Increase timeout from 1 to 10 ms (the previous one may be not enough

for non-empty queue).

Tested with:

• Intel 3945BG, STA mode.
• RTL8188CUS, STA mode.

Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D5147