Fix locking issues with proto dumps

Proto dumps are generated from:
 - binder threads when generating bugreports or triggering dumpstate
 - main thread when mLayerStats is enabled
 - tracing thread when winscope tracing is enabled.

The binder thread reads current state while the other threads reads drawing state.

The writeToProto function accesses a mix of current and drawing states. mPendingState should
only be accessed with the mStateLock held and the visible regions should be read from the main
or tracing threads. This causes some invalid access issues.

To make the locking requirements clear, this change
1. moves drawing specific data to a new function
2. copies mPendingState so we can dump the copy safely in main thread
3. dumps drawing data from binder threads by posting a message onto the main thread

Bug: 138318680
Test: adb shell dumpsys SurfaceFlinger, winscope

Change-Id: Ib2b49aedf06ee5a262d3162366ddf75d08432e05
Merged-In: I8bb93e9b9f81faec59585b770eb7ba0fbcd9b51b