Cleanup for readback buffer management:

* Tests exercising that a bad readback buffer is sent should actually
use a native_handle from a deallocated buffer rather than a valid
handle, since that would still work
* Creating a readback buffer should not require passing in a buffer at
construction. Instead ReadbackBuffer should always allocate its buffer
internally whenever a new buffer needs to be generated.
* Passing the readback buffer's fence to lockAsync should be a dup'd fd,
as lockAsync takes ownership of the fence

Bug: 213493262
Test: VtsHalGraphicsComposer3_TargetTest
Change-Id: I73396f982cf9a67f0dd81eaed509cf9cc7b03314