Fuzzer support for br_on_cast_desc_eq (#8935)

When we would generate a br_on_cast or br_on_cast_fail for a type that
has a descriptor, sometimes generate a br_on_cast_desc_eq or
br_on_cast_desc_eq_fail instead. Fix a validation bug newly found by the
fuzzer.