wimax: fix wrong downcast

Cast pointer to the correct type, fixing wimax issues reported in #166 (comment 325454397)

Sanitizer log

gabri@ubuntu:/mnt/dev/tools/source/ns-3-dev$ ./build/src/wimax/examples/wimax-simple 
/mnt/dev/tools/source/ns-3-dev/src/wimax/model/service-flow.cc:159:86: runtime error: downcast of address 0x6020000148b0 which does not point to an object of type 'U16TlvValue'
0x6020000148b0: note: object is of type 'ns3::U8TlvValue'
 48 00 00 36  c8 09 02 62 5c 7f 00 00  00 be be be be be be be  03 00 00 00 00 00 00 04  10 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'ns3::U8TlvValue'
/mnt/dev/tools/source/ns-3-dev/src/wimax/model/service-flow.cc:159:99: runtime error: member call on address 0x6020000148b0 which does not point to an object of type 'U16TlvValue'
0x6020000148b0: note: object is of type 'ns3::U8TlvValue'
 48 00 00 36  c8 09 02 62 5c 7f 00 00  00 be be be be be be be  03 00 00 00 00 00 00 04  10 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'ns3::U8TlvValue'
/mnt/dev/tools/source/ns-3-dev/src/wimax/model/wimax-tlv.cc:589:10: runtime error: member access within address 0x6020000148b0 which does not point to an object of type 'U16TlvValue'
0x6020000148b0: note: object is of type 'ns3::U8TlvValue'
 48 00 00 36  c8 09 02 62 5c 7f 00 00  00 be be be be be be be  03 00 00 00 00 00 00 04  10 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'ns3::U8TlvValue'