So far all double-buffered properties in our implementation of xdg-shell
weren't actually double-buffered. When a property setter is invoked, we
pray to the God hoping that the client committed associated surface.
This change introduces private SurfaceRole class. The new class provides
a way for SurfaceInterface to commit pending state of associated shell
The chosen architecture allows us to do more in the future. For example,
we could use SurfaceRole to prevent associating several roles to a single
wl_surface object, e.g. xdg-toplevel to a pointer surface, etc.