r4110: fixed pidl to allow arrays to have size_is() and length_is() elements

r4110: fixed pidl to allow arrays to have size_is() and length_is() elements
that depend on variables that come after the array in the structure or function.

This has been something that has been problematic for a while, but the
winreg QueryValue problem finally prompted me to fix it properly. We
should now go back and fix up all the ugly workarounds we have used to
avoid this problem in other calls.

Unfortunately the solution is fairly complex, and involves the use of
the internal ndr token lists (similar to the solution for relative
pointers). I wonder if anyone else will be able to follow the logic if
I get run over by a bus :-)