Refactor out the scan id and scan vap as part of the scan work.

Make the scan state optional - we'll obviously need a vap, but we now
won't require the scan state.  the only thing the scan state is needed
for is to check for the list of SSIDs to scan - which we can now
just plain ignore by passing in NULL as the scan state pointer.

Tested:

* Intel 5100 (STA)