GATTS: subscribe action security

It's nice that NimBLE automatically takes care of attribute security checks and kicks off encryption change procedure when a characteristic with READ_ENC or WRITE_ENC flags set.
However, it will not do this on notification mode change - even if the characteristic is marched as READ_ENC, central is allowed to subscribe to it without going through encryption change procedure, and the SUBSCRIBE event will fire.
While it is possible for the app to handle it and initiate the security procedure, it is cumbersome - context of the original SUBSCRIBE event needs to be preserved and acted upon if encryption change is successful, and discarded if not.
It would be nice if stack took care of this.

Start by tracing the GATTS subscribe handling and comparing it with the existing READ_ENC and WRITE_ENC security checks. Inspect how the SUBSCRIBE event and encryption change procedure are coordinated. Done means subscribing to a protected characteristic triggers the security procedure before the event is accepted, while unsuccessful security leaves the subscription request discarded.

Written by the indexing model from the issue text.