default-context: Do not allow restoring pushed gstates

The brackets defined by push/pop and save/restore are independent ad
should match properly.

This means that cairo_push()-ed gstates cannot be cairo_restore()-d
and cairo_save()-d gstates cannot be cairo_pop()-ed.

Fixes group-state.

src/cairo-default-context.c

@@ -119,6 +119,9 @@ _cairo_default_context_restore (void *abstract_cr)
 {
     cairo_default_context_t *cr = abstract_cr;
 
+    if (unlikely (_cairo_gstate_is_group (cr->gstate)))
+	return _cairo_error (CAIRO_STATUS_INVALID_RESTORE);
+
     return _cairo_gstate_restore (&cr->gstate, &cr->gstate_freelist);
 }