Surface: Always consume fence fd in queueBuffer

The API docs for the behaviour of ANativeWindow::queueBuffer state that
it always takes ownership of the fence fd parameter. The
Surface::queueBuffer implementation did not conform to this. If an error
occured within its queueBuffer function, then dependending what the
error was, the fence fd was either left untouched or closed.

This made it impossible for a client of ANativeWindow::queueBuffer to
correctly manage the fence fd if an error occured, resulting it either
an fd leak or a use-after-close scenario.

Change-Id: I3a8169709db3715dbcb3db258ef2056623e653f0