[Autofil] Make AutofillClock (almost) thread-safe

This CL makes AutofillClock::Now() thread-safe in production code
by preventing writes to `g_autofill_clock`.

That variable, now called `g_test_clock`, is now null in production
code.

In tests, there could be races between SetTestClock() and Now()
but hopefully tests call SetTestClock() only synchronously and
before any asynchronous Now() calls.

The new TestAutofillClock supports nesting -- not because it's needed
but because it's implemented as easily as DCHECKing that no nesting
happens.

Bug: 343037854
Change-Id: Iec7b6e7e6afea729fc7a65716035bb67b9f9af29
Cq-Do-Not-Cancel-Tryjobs: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5593786
Auto-Submit: Christoph Schwering <schwering@google.com>
Commit-Queue: Christoph Schwering <schwering@google.com>
Reviewed-by: Florian Leimgruber <fleimgruber@google.com>
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#1310529}