layers:Capture rect by value to validate 2nd cb

Fixes #2587

The lambda function was only capturing the pRect pointer by value so
the underlying rect value could still be changed between when the
command was submitted to a secondary CB and when the rect was validated
at CmdExecuteCommands() time.

Copy the actual rect value so that it can't change.