[style] Fix crash during app tear down sequence

We want to destroy a shadow after its decorated window has been destroyed
or unmapped. In order to do that, we install an event filter on the widget
and make the shadow a child of the window.

Unfortunately, the underlying window and the widget have different life
times. To ensure that _shadows has no dangling pointers, we will remove
the shadow when it's destroyed. The problem with doing so is that it will
invalidate iterators when ShadowHelper destroys all shadows during app
tear down, which will eventually result in a crash.

In order to keep iterators valid when ShadowHelper destroys shadows, we
need to clean up _shadows after the decorated window has been destroyed.