xfree86: Take second reference for SavedCursor in xf86CursorSetCursor

The same pointer is kept in CurrentCursor as well, therefore two
RefCursor calls are needed.

Fixes use-after-free after switching VTs.

Closes: xorg/xserver#1067
4 jobs for xfree86-SavedCursor-use-after-free in 4 minutes and 56 seconds (queued for 1 second)
Status Job ID Name Coverage
  Docker Image
passed #4328275
debian-testing

00:00:14

 
  Build And Test
passed #4328276
autotools

00:04:42

passed #4328277
meson

00:01:21

passed #4328278
meson-noglamor

00:01:06