Fix unreachable br_on_cast parse bug (#8948)

The br_on_cast* family of instructions take input and output type
immediates. We do not store the input type in the IR, so IRBuilder has
to check the type of the `ref` operand against the input type before the
input type is lost. For br_on_cast_desc_eq{_fail} instructions with
unreachable descriptor operands, we had a bug that would allow us to pop
a `ref` operand with an incorrect type, which would then immediately
fail that type check. This was incorrect because the unreachable `desc`
operand should have created a polymorphic stack that allowed popping any
valid type. Fix the bug by threading the expected input type through
IRBuilder to ChildTyper, where we can note the proper type constraint on
the `ref` operand.