compositor-wayland: strict surface create/destroy

Add safeguards to make it painfully obvious if we ever get the pairing
of wayland_backend_create_output_surface() and
wayland_backend_destroy_output_surface() wrong. Helps catching bugs.

Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>