wayland: Reference pixmap-based cursors' surface before handing the wl_buffer

wayland: Reference pixmap-based cursors' surface before handing the wl_buffer

cairo_surface_destroy() is called after the buffer is released, for every
wl_buffer. Windows usually reference their cairo surface before rendering,
so that extra reference is consumed after the buffer is released, so do
the same with cursor surfaces and add an extra reference whenever a cursor
surface change is about to be scheduled.

Otherwise, the GdkWaylandCursor is left with an invalid cairo_surface_t,
which causes crashes the next time it is used.

https://bugzilla.gnome.org/show_bug.cgi?id=735830