Support for sending BTM request frame to upper layer

Framework need to get MBO attributes and WNM mode fields from BTM request frame
Support the feature of BTM request notification

To take this feature, "btm_offload=1" add to wpa_supplicant.conf

Plus, call "MBO CELL_DATA_CAP" private command to advertise cellular capability to AP

Bug: b/154372567
Test: Test with manipulated BTM frames in Hikey960 (Android R-os)

1. Add "btm_offload=1" to "/data/vendor/wifi/wpa/wpa_supplicant.conf"
2. Setup SoftAP and assoc
3. "wl -i [SoftAP if] actframe [STA_MAC_ADDR] 0a07AA010000ff340d02904c07a4d900000000000b00340d02904c0e54d900000000009500dd07506f9a16060100" in SoftAP

the log below is seen in logcat
wpa_supplicant: wlan0: WNM: Send BSS Transition Management Request frame to upper layer

Signed-off-by: Dennis Jeon <dennis.jeon@broadcom.com>
Change-Id: I07137848cef47ee15f750871520119e7181f4c26
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index c10dd73..2f1e31b 100644
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -1646,6 +1646,12 @@
 # Set to 1 to disable BSS transition management
 #disable_btm=0
 
+# This value is used to set where to perform roaming logic
+# Set to 0 to handle roaming logic fully in supplicant
+# Set to 1 to skip roaming logic in supplicant and handle it in firmware
+# In supplicant, just parse BTM frame and notify framework
+#btm_offload=0
+
 # Enable EDMG capability in STA/AP mode, default value is false
 #enable_edmg=1