[WCF]: Update to my last fix for bug #22129.

The problem already starts when creating the OperationDescription; we need
to also look at the End* method here to correctly parse the reply parameters.

Then ClientRuntimeChannel.Process needs to distinguish between sync/async
and copy the out/byref parameters when needed.