cxa_demangle: avoid butchering the last parameter type

Fix an off-by-one case which would destroy the final parameter in a
CV-qualified function type with a reference.  We still get the CV
qualification incorrect, but at least we do not clobber the type name
any longer.

Partially fixes PR31741.

llvm-svn: 292963