xfree86: Take second reference for SavedCursor in xf86CursorSetCursor

The same pointer is kept in CurrentCursor as well, therefore two
RefCursor calls are needed.

Fixes use-after-free after switching VTs.

Closes: xorg/xserver#1067
4 jobs for xfree86-SavedCursor-use-after-free in 4 minutes and 56 seconds (queued for 1 second)