libui: fix passing Fence object over binder

The Fence object was writing a size_t into the binder buffer
in flatten, which changes size if the producer and consumer
are running in a 32-bit and a 64-bit process.  Use a uint32_t
instead.

Change-Id: Ifed526513800ce27f9d605101cddd922292cca37