Fix downcasting of base class pointers

When we are returned a base class pointer (either directly or via
shared_from_this()) we detect its runtime type (using `typeid`), then
end up essentially reinterpret_casting the pointer to the derived type.
This is invalid when the base class pointer was a non-first base, and we
end up with an invalid pointer.  We could dynamic_cast to the
most-derived type, but if *that* type isn't pybind11-registered, the
resulting pointer given to the base `cast` implementation isn't necessarily valid
to be reinterpret_cast'ed back to the backup type.

This commit removes the "backup" type argument from the many-argument
`cast(...)` and instead does the derived-or-pointer type decision and
type lookup in type_caster_base, where the dynamic_cast has to be to
correctly get the derived pointer, but also has to do the type lookup to
ensure that we don't pass the wrong (derived) pointer when the backup
type (i.e. the type caster intrinsic type) pointer is needed.

Since the lookup is needed before calling the base cast(), this also
changes the input type to a detail::type_info rather than doing a
(second) lookup in cast().

tests/test_multiple_inheritance.py

@@ -1,4 +1,5 @@
 import pytest
+from pybind11_tests import ConstructorStats
 
 
 def test_multiple_inheritance_cpp():
@@ -109,3 +110,52 @@ def test_mi_dynamic_attributes():
     for d in (mi.VanillaDictMix1(), mi.VanillaDictMix2()):
         d.dynamic = 1
         assert d.dynamic == 1
+
+
+def test_mi_base_return():
+    """Tests returning an offset (non-first MI) base class pointer to a derived instance"""
+    from pybind11_tests import (I801B2, I801C, I801D, i801c_b1, i801c_b2, i801d_b1, i801d_b2,
+                                i801e_c, i801e_b2)
+
+    n_inst = ConstructorStats.detail_reg_inst()
+
+    c1 = i801c_b1()
+    assert type(c1) is I801C
+    assert c1.a == 1
+    assert c1.b == 2
+
+    d1 = i801d_b1()
+    assert type(d1) is I801D
+    assert d1.a == 1
+    assert d1.b == 2
+
+    assert ConstructorStats.detail_reg_inst() == n_inst + 2
+
+    c2 = i801c_b2()
+    assert type(c2) is I801C
+    assert c2.a == 1
+    assert c2.b == 2
+
+    d2 = i801d_b2()
+    assert type(d2) is I801D
+    assert d2.a == 1
+    assert d2.b == 2
+
+    assert ConstructorStats.detail_reg_inst() == n_inst + 4
+
+    del c2
+    assert ConstructorStats.detail_reg_inst() == n_inst + 3
+    del c1, d1, d2
+    assert ConstructorStats.detail_reg_inst() == n_inst
+
+    # Returning an unregistered derived type with a registered base; we won't
+    # pick up the derived type, obviously, but should still work (as an object
+    # of whatever type was returned).
+    e1 = i801e_c()
+    assert type(e1) is I801C
+    assert e1.a == 1
+    assert e1.b == 2
+
+    e2 = i801e_b2()
+    assert type(e2) is I801B2
+    assert e2.b == 2