Add to pending controls in notifyControlRevoked

When the windowContainer of an InsetsSourceProvider is removed, it
will call onAnimationCancelled and then notifyControlRevoked. This
will remove the provider for the control target, before setting
mControlTarget to null in the provider itself, essentially notifying
the loss of control on the server side.

However, this does not guarantee that the update will always reach
the client, so the InsetsSourceConsumer might hold onto the stale
value. In some cases this can lead to an additional insets dispatch.

This adds the provider to the pending controls map in
notifyControlRevoked, following the same pattern as for updating
the previous control target in onControlTargetChanged. When
notifyPendingInsetsControlChanged is next called, it will add the
afterPrepareSurfacesRunnable. When this runnable starts, the
provider from the pending controls map will have a different control
target, as it was set to null in onAnimationCancelled, so it can
proceed with notifyInsetsControlChanged on the control target.

Flag: EXEMPT bugfix
Bug: 403662376
Test: atest InsetsStateControllerTest#testImeWindowRemoved_notifiesInsetsControlChanged
  WindowInsetsControllerTests#testImeInsetsFinalSizeIsMaximumSize
Change-Id: I5a78ef4c2b5b3e347ae4cc3501796b70d67397e6