fix oob write in memberRemapper for nested buffer_reference blocks

[saddamr3e]

ASAN, compiling a push-constant buffer_reference block whose first member is a struct wrapping another buffer_reference (repro from #3977):

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 4 at 0x...
#0 convertGlslangStructToSpvType  GlslangToSpv.cpp:6288
#1 convertGlslangToSpvType        GlslangToSpv.cpp:5867
freed/resized by memberRemapper[...].resize() at GlslangToSpv.cpp:5866

memberRemapper was keyed through glslangTypeToIdMap, whose operator[] returns id 0 for any struct member list never registered from a visited symbol. buffer_reference blocks reached only while building types are never registered, so distinct blocks all land on memberRemapper[0]. Converting the inner one-member block resizes that shared vector down to 1, then the outer two-member block's next member write runs past the end. In release builds the write just corrupts the heap silently, which is why it only shows up under a sanitizer or MSVC debug iterators.

glslangTypeToIdMap existed only to produce this key, so keying memberRemapper by the member-list pointer directly removes the collision and the map. Added spv.bufferReferenceNestedStruct.comp for the case; it trips the sanitizer before the fix and passes after.

Fixes #3977.