[Nearby] Fix destructor chain for webrt signaling

ReceiveMessagesExpress's dtor was indirectly calling back into
WebRtcSignalingMessenger and accessing incoming_messages_listener_
after it has already been destroy. By changing the ordering of the
member variables we ensure that ReceiveMessagesExpress gets torn down
before incoming_messages_listener_ is torn down.

Fixed: 1166520
Change-Id: I6b780b79ef7b857c281ea4eaa30f9dab71fe2262
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2630731Reviewed-by: Josh Nohle <nohle@chromium.org>
Commit-Queue: James Vecore <vecore@google.com>
Cr-Commit-Position: refs/heads/master@{#843814}

chrome/browser/nearby_sharing/webrtc_signaling_messenger.h

@@ -42,12 +42,12 @@ class WebRtcSignalingMessenger
                                   bool success);
   void OnMessageReceived(const std::string& message);
 
+  mojo::Remote<sharing::mojom::IncomingMessagesListener>
+      incoming_messages_listener_;
+
   TokenFetcher token_fetcher_;
   SendMessageExpress send_message_express_;
   ReceiveMessagesExpress receive_messages_express_;
-
-  mojo::Remote<sharing::mojom::IncomingMessagesListener>
-      incoming_messages_listener_;
 };
 
 #endif  // CHROME_BROWSER_NEARBY_SHARING_WEBRTC_SIGNALING_MESSENGER_H_