Bug 695260: Fix error handling in do_xobject

Various functions (such as fz_begin_group) handle errors internally
by use of the error_depth parameter. This means that if we call
them, we MUST ensure that we call the appropriate closing function.
Similarly, if we don't call them, we should NOT call the closing
function.

In order to ensure we do this correctly, we introduce a cleanup_state
variable that says which ones we tried to call.

This cures the original bug.