libweston: ensure backend is not loaded twice

Check and ensure that a compositor can only load one backend
successfully. If a backend fails to load, it is theoretically possible
to try another backend. Once loading succeeds, only destroying the
compositor would allow "unloading" a backend.

If backend init fail, ensure the backend pointer remains NULL to avoid
calling into a half-loaded backend on e.g. compositor destruction.

Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>