drm: Fix type confusion in writeback_state

wl_array_for_each() returns a pointer to each storage location; as we're
storing a pointer to drm_fb, this means that we have a drm_fb **, not a
drm_fb *.

Signed-off-by: Daniel Stone <daniels@collabora.com>