clients: ungrab the correct input when menus close

We need to input_ungrab() on the stored input, not the one that caused
the release - otherwise bad things can happen in multi-seat environments
when a seat that didn't open the menu closes it.

To reproduce:
 configure two seats
 launch weston terminal
 open the right click pop up
 select a menu item from the other seat

The next click from the seat that opened the menu will cause a segfault.

Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>

clients/window.c

@@ -4738,7 +4738,7 @@ menu_button_handler(struct widget *widget,
 		/* Either relase after press-drag-release or
 		 * click-motion-click. */
 		menu->func(menu->user_data, input, menu->current);
-		input_ungrab(input);
+		input_ungrab(menu->input);
 		menu_destroy(menu);
 	} else if (state == WL_POINTER_BUTTON_STATE_RELEASED) {
 		menu->release_count++;