wayland/subsurface: Hold sibling surface reference in placement ops
It was possible for the sibling surface to be already destroyed in meta_wayland_transaction_add_placement_surfaces, in which case g_object_ref would return NULL for it, and meta_wayland_transaction_commit would then crash dereferencing a NULL surface pointer.
Closes: #3462 (closed)