libgui: Fix attaching buffers without allocation

This changes the way that BufferQueue selects slots in
waitForFreeSlotThenRelock. This method is called from both
dequeueBuffer and attachBuffer, but those two methods actually have
different preferences:

dequeueBuffer wants a slot with a buffer if possible (to avoid
unnecessary allocations), but will settle for a slot without a buffer
if no free buffers are available.

attachBuffer wants a slot without a buffer if possible (to avoid
clobbering an existing buffer), but will settle with clobbering a free
buffer if no empty slots are available.

These preferences are now respected, which has the side-effect of
fixing a bug where it was not possible to attach a buffer if allocation
is disabled (since the previous implementation assumed finding a slot
without a buffer meant that the caller intended to allocate a buffer,
which would accordingly be blocked since allocation is disabled).

Bug: 26387372
Change-Id: Iefd550fd01925d8c51d6f062d5708d1f6d517edd