librpc ndr: add ndr_pull_steal_switch_value()