[A11y] Recompute AX subtree slottables elements that change tree scope

Any time the ancestry changes for nodes change, we need to
recompute the ax subtreee.

The crashing test exercises hits this code path:
```
// Some of the manually assigned nodes might have been moved
// to other trees or documents. In that case, don't assign them
// here, but also don't remove/invalidate them in the manually
// assigned nodes list, in case they come back later.
if (slottable && slottable->IsChildOfShadowHost() &&
    slottable->parentElement() == owner_->host()) {
  slot->AppendAssignedNode(*slottable);
  children_to_clear.erase(slottable);
}
```

Normally, |slottable| is not removed from children_to_clear_,
which results in these calls:
slottable->RemovedFromFlatTree() -> DetachLayoutTree() ->
AXObjectCacheImpl::RemoveSubtree(slottable);

We therefore need to ensure that RemoveSubtree() is called for
these.

Fixed: 346411879
Bug: 346158514
Change-Id: Ie7690c8cacd6e208e44cafa72b90ee6dfc2903ec
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5622819
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Mason Freed <masonf@chromium.org>
Reviewed-by: Mason Freed <masonf@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1314331}