wayland-surface: Make bad xdg-shell versions crash the client

Otherwise, we might continue with weird semantics.
wayland: Don't set_focus for new resources

Otherwise, we can re-add the destroy listener, which can cause
corruption.

Instead, split out the broadcast function, and use that.
wayland: Don't set_focus when the device has been released

It's possible for a released pointer to have repick / set_focus on it as
part of sync_input_focus. When the pointer is actually re-init'd, it
will memset 0, which can cause corruption as our destroy listener has
already been added.

Released devices should be idempotent, so just make sure method calls on
them don't have any effect.