Move surface save state tracking to WindowState.

In the current set up, surface saving is managed by the app window
token. So when destroySavedSurfaces is called, all saved surfaces
assosciated with a given app will be destroyed. This causes pretty weird
behavior where hiding child windows can destroy the parent window. We
move this tracking to WindowState and allow child windows to exempt themselves.

Bug: 25780116
Change-Id: I3ab92221d83297092dfd98a71e6a5fe96381de8b