WindowManager: Take care with Surface lifetime during relayout to invisible.

In the relayout to invisible case where we choose not to apply an exit
animation, we would call to WindowState#destroyOrSaveSurface bypassing
the app stopped check. Notice WindowManagerService.java L1953 we could
enter the relayout to invisible even if the client has not requested it
if clientHidden were set to true (but not yet processed by the client). This means
we can destroy the surface ahead of any notification to the client.  We instead
need to use the WindowState#destroySurface variant
and respect the app token mAppStopped flag. #destroySurface expects
mDestroying to have been set by the exit animation, so we will also need
to set that. If destruction is deferred, it will be completed later by
AppWindowToken#notifyAppStopped

Bug: 36561071
Bug: 37533373
Test: Manual from repro in bug.
Change-Id: If91b4c75fdbcbf87007551860f9eb64dbec9e032