Make RefCounted derived objects have private destructors

RefCounted (and derived) destructors should be protected on the class
to ensure the objects can ONLY be destructed by calling Release. This
avoids errors cause by destroying objects out from under code which
has an active reference count.

Unfortunately, many of the 'base' classes must continue having public
destructors because they are used as "blueprint" objects created on
the stack.

Added final on most-derived classes.

Ideas for future improvement:
- Change "base" objects to have protected destructors but create new
blueprint objects that privately derive from base objects. This
limits the blueprint object's usefulness to only be a blueprint.
- Modify createX methods to return Ref<Object> instead of Object*

Change-Id: I6f3b3b178118d135c4342cb912e982a3873d71af
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/18780
Commit-Queue: Rafael Cintron <rafael.cintron@microsoft.com>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>

src/dawn_native/SwapChain.cpp

@@ -25,7 +25,7 @@ namespace dawn_native {
 
     namespace {
 
-        class ErrorSwapChain : public SwapChainBase {
+        class ErrorSwapChain final : public SwapChainBase {
           public:
             ErrorSwapChain(DeviceBase* device) : SwapChainBase(device, ObjectBase::kError) {
             }