kmsro: assert that scanout refcount is larger than 0

kmsro: assert that scanout refcount is larger than 0

The dumb buffer backing the renderonly_scanout is only destroyed if the
refcount reaches zero. If a driver does not correctly initialize the
refcount, the refcount may be negative and the buffer will never be
freed.

Add an assert to ensure that drivers correctly initialize the refcount.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23743>