Make WebCore::IOSurface have single ownership instead of refcounting