Destroy all clients before destroying wl_display

One of the most disappointing things when writing autotests is dealing with a race condition where destructor requests are processed after all globals have been destroyed.

With this change, the Display object will destroy all clients and their resources before destroying the wl_display object. The good thing about doing so is that shut down logic becomes simple. We don't have to assume that wl_resource objects can outlive their wl_global objects, etc. The bad thing is that it exposed a couple of pre-existing latent bugs in the data device and the xdg foreign code.

closes #2 (closed)