Refine cull rect for SVGInlineTextBox painting

The PaintInfo cull rect can (will) change between paints, so use
the moral equivalent of logicalOverflowRect() to compute a more
accurate cull rect instead.

This fixes under-invalidation in the following tests:

 svg/dynamic-updates/SVGTextElement-dom-lengthAdjust-attr.html,
 svg/dynamic-updates/SVGTextElement-dom-textLength-attr.html,
 svg/dynamic-updates/SVGTextElement-svgdom-lengthAdjust-prop.html and
 svg/dynamic-updates/SVGTextElement-svgdom-textLength-prop.html

Exposed by https://codereview.chromium.org/2104943005

BUG=231560

Review-Url: https://codereview.chromium.org/2124553002
Cr-Commit-Position: refs/heads/master@{#404265}
4 files changed