[compositor] Prevent crash when extended surface is destroyed.

The surface is not destroyed synchronously with the extended surface
so there is a small chance that something accesses
Surface::extendedSurface() between the time when the extended
surface is destroyed and the Surface itself is cleaned up.

We also want to make sure that the extended surface is not hanging
around after the surface is destroyed, so nuke it immediately on
surface_destroy_resource.