Surface unocclussion is racy

Consider the following scenario as I saw investigating: https://bugs.launchpad.net/mir/+bug/1407783

1. Two surfaces on top of eachother
2. Send an event to first surface, wait for received signal.
3. Hide first surface
4. Send an event to second surface

It turns out the second surface will not always receive the event! I found the root: ms::SurfaceStack::for_each is filtering by occlusion. So of course, if the second event is synthesized before the compositor feedback occludes the second surface the surface will not be presented to the input stack and the event will be dropped.

This behavior is unfortunately required by: https://bugs.launchpad.net/bugs/1359264

So in order to address CI failures I have added extra synchronization in the test (referenced in bug 1407783) however, this remains a race which could appear in real scenarios (albeit somewhat marginal scenarios).