Make wpa_supplicant FLUSH command more likely to clear all BSS entries

Make wpa_supplicant FLUSH command more likely to clear all BSS entries

Move the wpa_bss_flush() call to the end of the function to allow any
pending user of a BSS entry to be cleared before removing the unused
entries. There were number of cases where BSS entries could have been
left in the list and this resulted in some hwsim test failures.

Signed-off-by: Jouni Malinen <j@w1.fi>