Clarify what you can do to outputs when destroying them

[Timidger]

Using an OutputHandle one can construct full Outputs "safely" even though it's scheduled to be destroyed.

To fix this, we should deallocate the Rc<()> before we enter the callback, probably by utilizing ManuallyDrop.

[Timidger]

Note this is only an issue if we ever make wlr_output_destroy part of the API surface. It might be an issue in other cases though that I'm not thinking of, but that's definitely a bad one.

Of course, that might just need a special case...e.g it might need to consume Output, though I don't think I ever make that possible within the API surface.