wayland/cursor: Keep a private use count and reference to active buffer

In order for the native cursor renderer to be able to create a hw
cursor in response to wl_pointer.set_cursor(), keep a private use-count
and reference to the active buffer, stopping it from being released
until it is consumed, replaced, or the surface is destroyed.

https://bugzilla.gnome.org/show_bug.cgi?id=762828