c++: Fix tsubst ICE with invalid static_cast [PR95728]

c++: Fix tsubst ICE with invalid static_cast [PR95728]

Since r11-423 tsubst_copy_and_build/TREE_LIST uses tsubst_tree_list
instead of open coding it.  While the latter could return an error
node wrapped in a TREE_LIST, the former can return a naked error node.

That broke in tsubst_copy_and_build/NEW_EXPR:
  tree placement = RECUR (TREE_OPERAND (t, 0));
  // placement is now error_mark_node, so...
  for (; placement != NULL_TREE; placement = TREE_CHAIN (placement))
  // ... this crashes

If we just return, we avoid the ICE and improve the diagnostic a bit.

gcc/cp/ChangeLog:

	PR c++/95728
	* pt.c (tsubst_copy_and_build) <case NEW_EXPR>: Return error_mark_node
	if placement is erroneous.

gcc/testsuite/ChangeLog:

	PR c++/95728
	* g++.dg/template/cast6.C: New test.