CLEANUP: mux-quic: always take the endp from the qcs not the cs

At a few places the endpoint pointer was retrieved from the conn_stream
while it's safer and more long-term proof to take it from the qcs. Let's
just do that.
diff --git a/src/mux_quic.c b/src/mux_quic.c
index d5f448c..0d7d424 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -1298,15 +1298,15 @@
 
  end:
 	if (b_data(&qcs->rx.app_buf)) {
-		cs->endp->flags |= (CS_EP_RCV_MORE | CS_EP_WANT_ROOM);
+		qcs->endp->flags |= (CS_EP_RCV_MORE | CS_EP_WANT_ROOM);
 	}
 	else {
-		cs->endp->flags &= ~(CS_EP_RCV_MORE | CS_EP_WANT_ROOM);
-		if (cs->endp->flags & CS_EP_ERR_PENDING)
-			cs->endp->flags |= CS_EP_ERROR;
+		qcs->endp->flags &= ~(CS_EP_RCV_MORE | CS_EP_WANT_ROOM);
+		if (qcs->endp->flags & CS_EP_ERR_PENDING)
+			qcs->endp->flags |= CS_EP_ERROR;
 
 		if (fin)
-			cs->endp->flags |= CS_EP_EOI;
+			qcs->endp->flags |= CS_EP_EOI;
 
 		if (b_size(&qcs->rx.app_buf)) {
 			b_free(&qcs->rx.app_buf);