Make private the constructors of Surface.

This enforces the creation of Surface with new/delete.