Fixes invalid dereference in animated cursor sort

`Wayland_CreateAnimatedCursor` calls `SDL_qsort` on an array of
type `**SDL_Surface`, not on an array of `*SDL_Surface`. As such the void
pointers in the callback need to be casted to `SDL_Surface **` not
`SDL_Surface *`.

This was likely not caught since it's very unlikely that reading a few
bytes past the end of this array results in reading unreadable memory,
so the only side effect was invalid sort results, which is a bit subtle.

I caught this because I build SDL with UBSAN enabled in my debug builds,
and it trapped when the multiplication of the garbage `SDL_Surface*`
width and heights overflowed. I validated that the change is correct by
adding logs (that have then since been removed) demonstrating that it
was previously comparing garbage, and is now comparing the actual cursor
surfaces.

(cherry picked from commit a168e96cbcf88f8b858b8d9f0c73819010634583)

src/video/wayland/SDL_waylandmouse.c

@@ -717,8 +717,8 @@ static bool Wayland_GetSystemCursor(SDL_CursorData *cdata, SDL_WaylandCursorStat
 
 static int surface_sort_callback(const void *a, const void *b)
 {
-    SDL_Surface *s1 = (SDL_Surface *)a;
-    SDL_Surface *s2 = (SDL_Surface *)b;
+    SDL_Surface *s1 = *(SDL_Surface **)a;
+    SDL_Surface *s2 = *(SDL_Surface **)b;
 
     return (s1->w * s1->h) <= (s2->w * s2->h) ? -1 : 1;
 }