[SurfaceFlinger] Callback to renderengine when erasing BLAST buffers

Otherwise we may leak if BufferStateLayer is destroyed first.

Bug: 137514000
Test: Over 61 hours, ran: while [ true ]; do am start -n \
com.android.chrome/com.google.android.apps.chrome.Main \
http://m.youtube.com; sleep 10; input tap 740 740 ; sleep 10; input \
keyevent HOME; sleep 0.5; am force-stop com.android.chrome; sleep 0.5; \
done
Test: Over >30 minutes: while [ true ]; do am start -n \
com.android.chrome/com.google.android.apps.chrome.Main \
http://m.youtube.com; sleep 10; input tap 740 740; \
sleep 1; content insert --uri content://settings/system --bind \
name:s:user_rotation --bind value:i:1; sleep 4; content insert --uri \
content://settings/system --bind name:s:user_rotation --bind value:i:0; \
sleep 5; input keyevent HOME; sleep 0.5; \
am force-stop com.android.chrome; sleep 0.5; done
Test: CtsViewTestCases:ASurfaceControlTest
Test: CtsViewTestCases:SurfaceControlTest
Test: Transaction_test

Change-Id: I743eb8bd9887d17e08b6f1b8e8ec5874359df175