The callers assumed that gdk_memory_sanitize is transfer full in
both directions, but it wasn't. Make it so.