Instead of painting on the vcl::Window directly, take a
PaintBufferGuard, and use the vcl::RenderContext of it, that may be
either the vcl::Window or the toplevel frame's buffer.

Trigger the paint of the buffer by informing the guard what area was
painted. In case of direct painting, both the ctor and the dtor of the
guard is a NOP.

This means that finally we can also assert Invert() calls on the output
device, so that direct paint can't happen when double-buffering.

Also:

- make PaintBufferGuard visible outside paint.cxx
- move buffer paint logic to PaintBufferGuard

(cherry picked from commits c85b2511,
a6c7a0bf and
c64a7ce1)

Change-Id: I0322563369dc63b3c49061cbe7c4a911cb13a2e2
Reviewed-on: https://gerrit.libreoffice.org/17576Reviewed-by: Tomaž Vajngerl <quikee@gmail.com>
Tested-by: Jenkins <ci@libreoffice.org>