audioflinger: fix race condition in SyncEvent callback

Now that the SyncEvent callback is implemented by the
RecordTrack instead of the RecordThread, there is a possibility
that the callback is called after the track deletion.

SyncEvent callback now uses a weak pointer instead of
a raw pointer as cookie. This allows the callback implementer to
acquire a strong reference on the object pointed to by the cookie.

Bug: 13114128.
Change-Id: Id61b8f06044ed1e52c6f7e7c666cdede68340de2