Add ar9300_get_next_tbtt().

Tested:

* AR9380, STA mode