Sema: Don't crash when an inject class name has a nested redefinition

We expected the type of a TagDecl to be a TagType, not an
InjectedClassNameType.  Introduced a helper method, Type::getAsTagDecl,
to abstract away the difference; redefine Type::getAsCXXRecordDecl to be
in terms of it.