surfaceflinger: fix fence fd double close

The unique_fd in BufferLayerConsumer::syncForReleaseLocked is
wrapped in a Fence immediately.  We should not let both own the
fence fd.

Bug: 70976329
Bug: 70982313
Test: manual
Change-Id: Ib4d6bce8519f1b026c59fdfd0e57f93920025b0c
diff --git a/services/surfaceflinger/BufferLayerConsumer.cpp b/services/surfaceflinger/BufferLayerConsumer.cpp
index e39ebcc..16c3254 100644
--- a/services/surfaceflinger/BufferLayerConsumer.cpp
+++ b/services/surfaceflinger/BufferLayerConsumer.cpp
@@ -392,7 +392,7 @@
 
     if (mCurrentTexture != BufferQueue::INVALID_BUFFER_SLOT) {
         if (SyncFeatures::getInstance().useNativeFenceSync()) {
-            base::unique_fd fenceFd = mRE.flush();
+            int fenceFd = mRE.flush().release();
             if (fenceFd == -1) {
                 BLC_LOGE("syncForReleaseLocked: failed to flush RenderEngine");
                 return UNKNOWN_ERROR;