backend/wayland: don't cache next item when destroying buffers
Because wl_buffer.release is per-buffer and not per-commit, the Wayland backend might create multiple struct wlr_wl_buffer per struct wlr_buffer. As a result, the wlr_buffer_unlock() call inside destroy_wl_buffer() can cause another struct wlr_wl_buffer to be destroyed.
In backend_destroy() we were iterating the list of buffers with wl_list_for_each_safe(), which is actually not safe in this case: the next buffer is cached, but might be destroyed as a side-effect of calling destroy_wl_buffer().
Closes: #3572 (closed)