chore: cherry-pick fix for 1227933 from chromium

[zcbenz]

Merge 4577: Fix nested inline box fragmentation

This patch fixes when nested inline boxes are fragmented in a
line due to bidi reordering.

Before this change, the fragmented boxes are appended to the
end of |box_data_list_|. Then when |NGInlineLayoutStateStack::
CreateBoxFragments| creates inline boxes in the ascending
order of |box_data_list_|, it failed to add the fragmented
boxes into their parent inline boxes.

This is critical for out-of-flow positioned objects whose
containing block is an inline box, because they expect to be
propagated through all ancestor inline boxes.

|UpdateBoxDataFragmentRange| is a little tricky by appending
to a vector it is iterating. Changing it to insert to the
correct position makes the function even trickier. This patch
changes it to add fragmented boxes to a separate vector, and
let later process |UpdateFragmentedBoxDataEdges| to merge the
vector to |box_data_list_|.

(cherry picked from commit 9c8a39c14a9c80556468593cddf436f5047a16ce)

Bug: 1227933, 1229999
Change-Id: I7edcd209e1fdac06bab01b16d660383e7e9c37bd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3038308
Commit-Queue: Koji Ishii kojii@chromium.org
Reviewed-by: Yoshifumi Inoue yosin@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#903356}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3053212
Commit-Queue: Rubber Stamper rubber-stamper@appspot.gserviceaccount.com
Bot-Commit: Rubber Stamper rubber-stamper@appspot.gserviceaccount.com
Auto-Submit: Koji Ishii kojii@chromium.org

[modify] https://crrev.com/e17983c2294a81bbc44f867ce319320cc11ff94f/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc
[modify] https://crrev.com/e17983c2294a81bbc44f867ce319320cc11ff94f/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.h
[add] https://crrev.com/e17983c2294a81bbc44f867ce319320cc11ff94f/third_party/blink/web_tests/external/wpt/css/CSS2/text/crashtests/bidi-inline-fragment-oof-crash.html

Notes: Security: Backported fix for 1227933.

[release-clerk]

Release Notes Persisted

Security: Backported fix for 1227933.

[trop]

I have automatically backported this PR to "11-x-y", please check out #30614

[trop]

I have automatically backported this PR to "12-x-y", please check out #30615