desktop-shell: Don't crash if the output is removed in startup

If the output is destroyed between setting the panel and committing the
panel, or between setting the background and committing the background,
we have a use after free crash.

Handle this by clearing the surface private pointers on output destroy
so we can skip the useless commits.

Signed-off-by: Derek Foreman <derek.foreman@collabora.com>