CLEANUP: mux-h1: always take the endp from the h1s not the cs

At a few places the endpoint pointer was retrieved from the conn_stream
while it's safer and more long-term proof to take it from the h1s. Let's
just do that.
diff --git a/src/mux_h1.c b/src/mux_h1.c
index f923f33..31a8a47 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3481,9 +3481,9 @@
 
 	TRACE_ENTER(H1_EV_STRM_SHUT, h1c->conn, h1s, 0, (size_t[]){mode});
 
-	if (cs->endp->flags & CS_EP_SHR)
+	if (h1s->endp->flags & CS_EP_SHR)
 		goto end;
-	if (cs->endp->flags & CS_EP_KILL_CONN) {
+	if (h1s->endp->flags & CS_EP_KILL_CONN) {
 		TRACE_STATE("stream wants to kill the connection", H1_EV_STRM_SHUT, h1c->conn, h1s);
 		goto do_shutr;
 	}
@@ -3504,7 +3504,7 @@
 
   do_shutr:
 	/* NOTE: Be sure to handle abort (cf. h2_shutr) */
-	if (cs->endp->flags & CS_EP_SHR)
+	if (h1s->endp->flags & CS_EP_SHR)
 		goto end;
 
 	if (conn_xprt_ready(h1c->conn) && h1c->conn->xprt->shutr)
@@ -3524,9 +3524,9 @@
 
 	TRACE_ENTER(H1_EV_STRM_SHUT, h1c->conn, h1s, 0, (size_t[]){mode});
 
-	if (cs->endp->flags & CS_EP_SHW)
+	if (h1s->endp->flags & CS_EP_SHW)
 		goto end;
-	if (cs->endp->flags & CS_EP_KILL_CONN) {
+	if (h1s->endp->flags & CS_EP_KILL_CONN) {
 		TRACE_STATE("stream wants to kill the connection", H1_EV_STRM_SHUT, h1c->conn, h1s);
 		goto do_shutw;
 	}