keybindings: fix invalid read after a keybinding is removed

The handler pointer is dangling in MetaKeyBinding until
rebuild_key_binding_table() is run, so we can't dereference it.
Because we only need the flags at ungrab time, store a copy
in the MetaKeyBinding structure.

https://bugzilla.gnome.org/show_bug.cgi?id=724402

src/core/keybindings-private.h

@@ -47,6 +47,7 @@ struct _MetaKeyBinding
   KeyCode keycode;
   unsigned int mask;
   MetaVirtualModifier modifiers;
+  gint flags;
   MetaKeyHandler *handler;
 };