Parse: Fix crash in error recovery path with specifier before parameter name

We should let Sema set ParamDecl's specifier always, instead of setting
it in the parser in this odd corner case where we're recovering from
'inout' being written before the parameter name.

Author: slavapestov

lib/Parse/ParsePattern.cpp

@@ -425,7 +425,7 @@ mapParsedParameters(Parser &parser,
                          Identifier argName, SourceLoc argNameLoc,
                          Identifier paramName, SourceLoc paramNameLoc)
   -> ParamDecl * {
-    auto param = new (ctx) ParamDecl(paramInfo.SpecifierKind,
+    auto param = new (ctx) ParamDecl(VarDecl::Specifier::Default,
                                      paramInfo.SpecifierLoc,
                                      argNameLoc, argName,
                                      paramNameLoc, paramName, Type(),

test/decl/subscript/subscripting.swift

@@ -381,4 +381,8 @@ struct InOutSubscripts {
 
   subscript(x3: (inout Int) -> ()) -> Int { return 0 } // ok
   subscript(x4: (inout Int, inout Int) -> ()) -> Int { return 0 } // ok
+
+  subscript(inout x5: Int) -> Int { return 0 }
+  // expected-error@-1 {{'inout' before a parameter name is not allowed, place it before the parameter type instead}}
+  // expected-error@-2 {{'inout' must not be used on subscript parameters}}
 }