libbinder: Support reading/writing out T[] lengths

T[] types are special: the length of the out array is written
into the inbound parcel to signal the expected length to the
server.

Bug: 30836680
Change-Id: I4f2f39fd7b1a6b94a25bd7f6c3baed430fd567bc
Test: integration tests pass with this change.