Copy child window list when destroying surface

When removing a child window, we may trigger a layout pass via:

WindowState.removeImmediately calls
WMS.postWindowRemoveCleanupLocked calls
WindowPlacer.performSurfacePlacement

Then, under certain conditions, we either remove a window from
mService.mForceRemoves or mService.mPendingRemove. If a child
is in any of these two lists, it will lead to a crash.

Test: go/wm-smoke
Change-Id: I4eac6a6ec9092521542590fad1aa9643818b2fe6
Fixes: 71499373