Re-add mistakenly removed lock in SurfaceFlinger::removeLayer.

Lock was mistakenly removed with "Add detachChildren transaction"
when refactoring the weak-pointer to a strong-pointer.

Test: I will try and follow up with a stress-test in Transaction_test.
Bug: 36117490
Change-Id: I94171c86334bb52b974392186e1c3ebbf9f33a05
(cherry picked from commit 7f9b899c33c5d69597bc676c0bee828819c97a0f)
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 46f5a1f..b6872e4 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -2546,6 +2546,8 @@
 }
 
 status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer) {
+    Mutex::Autolock _l(mStateLock);
+
     const auto& p = layer->getParent();
     const ssize_t index = (p != nullptr) ? p->removeChild(layer) :
         mCurrentState.layersSortedByZ.remove(layer);
diff --git a/services/surfaceflinger/SurfaceFlinger_hwc1.cpp b/services/surfaceflinger/SurfaceFlinger_hwc1.cpp
index 6cd7152..3c8d31e 100644
--- a/services/surfaceflinger/SurfaceFlinger_hwc1.cpp
+++ b/services/surfaceflinger/SurfaceFlinger_hwc1.cpp
@@ -2317,6 +2317,8 @@
 }
 
 status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer) {
+    Mutex::Autolock _l(mStateLock);
+
     const auto& p = layer->getParent();
     const ssize_t index = (p != nullptr) ? p->removeChild(layer) :
              mCurrentState.layersSortedByZ.remove(layer);