wayland: Destroy frame callback when destroying surface

wayland: Destroy frame callback when destroying surface

If a frame callback is not destroyed when destroying a surface, its
handler function will be invoked if the surface was destroyed after the
callback was requested but before it was invoked, causing a write on
free:ed memory.

This can happen if eglDestroySurface() is called shortly after
eglSwapBuffers().

Note: This is a candidate for stable branches.

Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
(cherry picked from commit a3b6b2d3055070da9bf7054fecfd0b171c398eb7)