Lock in Surface#destroy

Previously, destroy just directly called release, which was already
locked. Now, destroy invokes some functions in native. This means if
another thread is calling release during the destroy call, it could
cause crashes.

Test: Hard to repro bug
Bug: 223412469
Change-Id: Ie6415f505bbc86505e3fe3ea2a0bea96a3e78ad3