Reference shm pool for destroyed buffers

Currently, if an application is closed, all of its shm buffers will be
destroyed. However, the compositor may want to access them to fade out
the window.

With this change, the underlying shm pool will be referenced when a shm
buffer is destroyed. So, the compositor can access buffer data even if
the buffer is destroyed.