Camera: Fix race condition in Camera3BufferManager

detachBuffer is called with mLock temporarily released, which causes
race condition with getBufferForStream() when the last buffer is being
dequeued at the same time.

Address the race by modifying attachedBufferCount before releasing the
lock, and changing it back if detachBuffer fails to detach any buffer.

Flag: EXEMPT bugfix
Test: run testSurfaceSet in a loop
Bug: 421657430
Change-Id: I9086aa386f1a41a717d10b93a58fa7766eb1c02a