compositor: Only send release event in response to wl_surface.attach

The current semantics would implicitly attach the most recently attached
buffer at commit time and send a release event when the buffer enventually
was released.  The implicit attach is a little too subtle though and this
patch changes the semantics to always only send release events in response
to an attach event.  As a consequence, once a compositor releases a buffer,
it no longer has a reference to it and wl_surfcea.damage is undefined.
Thus, the client side visible change is that damage request must always
be preceeded by a wl_surface.attach request, to ensure there's a valid buffer,
even if that means attaching the same buffer again.

src/compositor.c

@@ -1426,6 +1426,9 @@ surface_commit(struct wl_client *client, struct wl_resource *resource)
 		surface->configure(surface, surface->pending.sx,
 				   surface->pending.sy, buffer_width, buffer_height);
 
+	if (surface->pending.buffer)
+		wl_list_remove(&surface->pending.buffer_destroy_listener.link);
+	surface->pending.buffer = NULL;
 	surface->pending.sx = 0;
 	surface->pending.sy = 0;
 	surface->pending.newly_attached = 0;