LibWeb: Special case SVG masks during layout

Rather than try to lay out masks normally, this updates the TreeBuilder
to create layout nodes for masks as a child of their user (i.e. the
masked element). This allows each use of a mask to be laid out
differently, which makes supporting `maskContentUnits=objectBoundingBox`
fairly easy.

The `SVGFormattingContext` is then updated to lay out masks last (as
their sizing may depend on their parent), and treats them like
viewports.

This is pretty ad-hoc, but the SVG specification does not give any
guidance on how to actually implement this.

Userland/Libraries/LibWeb/Layout/TreeBuilder.h

@@ -23,6 +23,7 @@ public:
 private:
     struct Context {
         bool has_svg_root = false;
+        bool layout_svg_mask = false;
     };
 
     i32 calculate_list_item_index(DOM::Node&);