hw/xfree86: Avoid cursor use after free

During a VT-Switch a raw pointer to the shared cursor object
is saved which is then freed (in case of low refcount) by a call to
xf86CursorSetCursor with argument pCurs = NullCursor.
This leads to a dangling pointer which can follow in a use after free.

This fix ensures that there is a shared handle saved for the VT-Switch cycle.

Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
4 jobs for cursor-fix-use-after-free in 3 minutes and 43 seconds (queued for 2 seconds)