One of the most disappointing things when writing autotests is dealing
with a race condition where destructor requests are processed after all
globals have been destroyed.

With this change, the Display object will destroy all clients and their
resources before destroying the wl_display object. The good thing about
doing so is that shut down logic becomes simple. We don't have to assume
that wl_resource objects can outlive their wl_global objects, etc. The
bad thing is that it exposed a couple of pre-existing latent bugs in the
data device and the xdg foreign code.

closes #2