Ensure EphyShell and all EphyWindows are destroyed
In #2130 (closed) we had two separate problems resulting in EphyWindows being leaked.
I tried adding an assertion to EphyShell to guarantee that all EphyWindows are destroyed before the EphyShell, but this failed because the EphyShell is itself leaked. So we also need an assertion to guarantee the EphyShell is itself destroyed. To add that assertion, we have to first figure out why it's leaked.