pixman: Destroy pixman images when underlying buffer is destroyed

While the pixman image might be attached, the underlying buffer might be
already gone under certain circumstances. This is easily reproduced by
attempting to resize gnome-terminal on a fbdev backend.

$ WAYLAND_DEBUG=1 strace -emunmap weston --backend=fbdev-backend.so
...
[1524826.942] wl_shm@7.create_pool(new id wl_shm_pool@23, fd 40, 1563540)
[1524827.315] wl_shm_pool@23.create_buffer(new id wl_buffer@24, 0, 759, 515, 3036, 0)
...
[1524829.488] wl_surface@14.attach(wl_buffer@24, 0, 0)
[1524829.766] wl_surface@14.set_buffer_scale(1)
[1524829.904] wl_surface@14.damage(0, 0, 759, 515)
[1524830.248] wl_surface@14.frame(new id wl_callback@25)
[1524830.450] wl_surface@14.commit()
...
[1524846.706] wl_shm@7.create_pool(new id wl_shm_pool@26, fd 40, 1545000)
[1524847.215] wl_shm_pool@26.create_buffer(new id wl_buffer@27, 0, 750, 515, 3000, 0)
[1524847.735] wl_buffer@24.destroy()
[1524847.953]  -> wl_display@1.delete_id(24)
[1524848.144] wl_shm_pool@23.destroy()
munmap(0xb5b2e000, 1563540)             = 0
[1524849.021]  -> wl_display@1.delete_id(23)
[1524849.425] wl_surface@14.attach(wl_buffer@27, 0, 0)
[1524849.730] wl_surface@14.set_buffer_scale(1)
[1524849.821] wl_surface@14.damage(0, 0, 750, 515)
<No commit yet, so drawing is attempted from older buffer that used to be
 attached to the surface, which happens to come from a destroyed pool,
 resulting it an invalid read from address 0xb5b2e000>

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
compositor: Destroy renderer in weston_compositor_shutdown()

Currently we destroy the renderer before the outputs are destroyed, but
that sometimes leads to an error since a reference to the renderer is
necessary in order to destroy a gl_renderer_output.

Since destroying the renderer is common among all backends, just move
that call into weston_compositor_shutdown() immediately after the
outputs being destroyed.
shell: Handle the desktop shell client destroy signal

Set the internal pointer for the client to NULL. This fixes a
segmentation fault at shutdown, where the shell would hang up before
and cause libwayland to call wl_client_destroy(). When the shell was
destroyed later, another call to wl_client_destroy() would cause the
crash.

https://bugs.freedesktop.org/show_bug.cgi?id=72550
Release pointer and keyboard with the seat

This patch fixes seat releasing during a RDP disconnection.
It does not fully fix https://bugs.freedesktop.org/show_bug.cgi?id=66830,
but makes things better.