[ReferenceTarget] return null if reference target points to invalid ID

The background of this CL can be found here:
https://github.com/WICG/webcomponents/issues/1071

Currently, the main logic for retrieving the referenced target is
implemented in GetShadowReferenceTarget. However, the function has a
limitation where when it returns nullptr, it’s unclear whether it's due
to the element lacking a shadow root with a specified referenceTarget,
or because the referenceTarget has an invalid ID.

This CL re-implements the retrieval logic in
GetShadowReferenceTargetOrSelf, so instead of calling
GetShadowReferenceTarget, it checks shadow root (recursively if nested
layers) and returns the target element. If at any layer, referenceTarget
is specified but the ID is invalid, it returns nullptr.

This CL also updates 2 existing tests to verify nullptr is returned, and
adds 3 more tests to verify nested cases and duplicate IDs.

Note: 1. const Element* GetShadowReferenceTargetOrSelf is removed as
it's not used.

2.
content/test/data/accessibility/aria/aria-activedescendant-reference-target-dynamic-expected-blink.txt
is rebaselined. The result matches the behavior where
aria-activedescendant is set to an invalid ID, e.g.,
aria-activedescendant="invalid-id" in
content/test/data/accessibility/aria/aria-activedescendant-reference-target-dynamic.html

3. we might be able to update all callers of GetShadowReferenceTarget to
call GetShadowReferenceTargetOrSelf, which would make the logic easier
to follow. This will be addressed in another CL.

Bug: 374127243
Change-Id: I3972569e0f262911a1f888d3cf372f056e215bcf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6199823
Reviewed-by: Mason Freed <masonf@chromium.org>
Reviewed-by: Dan Clark <daniec@microsoft.com>
Commit-Queue: Alex Keng <shihken@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1412034}