create_surfaces is unsound

[spectria-limina]

Bevy version

0.15

What went wrong

In create_surfaces, the underlying create_surface_unsafe is called under the assumption that any surface target inside of ExtractedWindows is guaranteed to be valid.

This isn't true, however. The fields on RawHandleWrapper are public, so any user could insert garbage data and cause the call to create_surface_unsafe to use invalid data.

Propose solution

Make RawHandleWrapper's fields private, replacing them with accessors and unsafe constructors.

[alice-i-cecile]

I think that solution is good.