Fix race condition when destroying proxies

We have a race condition (#86 (closed)) when destroying proxies, because we call wl_proxy_marshal() wl_proxy_destroy()

Both of which hold and release the display mutex. It's possible for another thread to be scheduled when the mutex is dropped, and bad things happen.

Fix this by introducing a new wl_proxy_marshal_flags() call that allows us to atomically marshal and destroy under one lock.