It is quite possible for os_create_anonymous_file() to fail when trying
to allocate a new wl_shm buffer. Propagate this failure out from
shm_surface_prepare. Most parts of toytoolkit are already avoiding NULL
cairo surfaces.

If cairo surface allocation fails, do not try to call the widget redraw
functions, those are not prepared to deal with NULL. Also do not
schedule a frame callback, this allows us to retry drawing the next
time.

If redraw fails for the main_surface of a window, restore the widget
geometry to what the compositor currently is showing. This keeps the
window visual appearance in sync with application state, so interacting
with the application does not break too badly.

If the very first draw of any window fails, then forcefully exit the
program. E.g. if weston-desktop-shell fails to allocate buffers for the
unlock dialog, w-d-s exits, and weston unlocks the screen automatically.

This patch allows e.g. weston-terminal to stop from enlarging while
resizing, if new sized buffers can no longer the allocated. Even then,
the application stays usable, as it can often repaint in the last
successful size. It does not crash, and the user is able to resize it
smaller, too.

Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>