SF: pass acquire fence on BLAST callbacks

When latching unsignaled buffers, the acquire fence is
not signaled by the time BLAST callback is invoked. In
that case pass a fence instead. For latch signaled, we still
pass the acquire time itself to avoid sending file descriptors
over binder.

Bug: 198190384
Test: SF unit tests
Change-Id: Ic7ad9b603b60dbf46a62eaf6b76bfbdeeebf6cec
diff --git a/services/surfaceflinger/BufferStateLayer.h b/services/surfaceflinger/BufferStateLayer.h
index 4256212..669eaad 100644
--- a/services/surfaceflinger/BufferStateLayer.h
+++ b/services/surfaceflinger/BufferStateLayer.h
@@ -145,7 +145,7 @@
 
     // Stores the last set acquire fence signal time used to populate the callback handle's acquire
     // time.
-    nsecs_t mCallbackHandleAcquireTime = -1;
+    std::variant<nsecs_t, sp<Fence>> mCallbackHandleAcquireTimeOrFence = -1;
 
     std::deque<std::shared_ptr<android::frametimeline::SurfaceFrame>> mPendingJankClassifications;
     // An upper bound on the number of SurfaceFrames in the pending classifications deque.