updated paint message policy and removed unnecessary render layer buffer set cloning

* constellation grants permission to renderers instead of passing tokens
* render tasks wrap layer buffer sets in ARCs
* removed no-longer-used field (constellation chan) from render task struct