Design test clients to ensure `destroyed` handlers are properly called

[i509VCB]

Discussion on matrix with @chrisduerr related a bug in calling XdgShellHandler::toplevel_destroyed resulted in destruction never being done right since we removed a surface from the known list before getting the surface to destroy.

This bug probably exists elsewhere or could creep back in the future. To prevent this, we should design some special test clients that assert the destroyed handlers are called at the correct time when the client destroys an object, dies or is disconnected.