Fix broken config change handling in the mojo demuxers.
The null buffers were not handled correctly. The config change
queue system was also incorrect. OnBufferReady() may be in the
process of handling a Read() call, so the read_cb_ can't be reset
immediately once the OnXXXConfigChanged() message is received, it
must wait for the kConfigChange status buffer.
BUG=none
TEST=pipeline integration tests \o/
Review URL: https://codereview.chromium.org/
791983004
Cr-Commit-Position: refs/heads/master@{#308703}