Fix UAF in LoginStateChecker and related browser tests

This CL fixes a use-after-free in `LoginStateChecker` and a related
off-by-one error in its browser tests.

The first issue was in `RespondWithLoginStatus`, where a callback was
run before incrementing a member variable. If the callback destroyed the
instance, this led to a UAF. The fix is to increment the counter before
invoking the callback.

Re-enabling the browser tests revealed a second UAF. The tests were
calling `RespondWithLoginStatus` `kMaxLoginChecks + 1` times due to an
off-by-one error in a loop. Since the `LoginStateChecker` destroys
itself after `kMaxLoginChecks` calls, the final call was on a dangling
pointer. This CL also corrects the test loop.

With both fixes, the following tests are now stable and re-enabled:
- PasswordChangeDoesNotStartUserIsLoggedOut
- OpenTabWhenLoggedOut
- PasswordChangeStartsUserIsLoggedIn

Bug: 441807493
Change-Id: Ieb91f2c24753e45577db4594b67043bf7cf09922
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6899063
Owners-Override: Yoshisato Yanagisawa <yyanagisawa@google.com>
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Commit-Queue: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Reviewed-by: Viktor Semeniuk <vsemeniuk@google.com>
Cr-Commit-Position: refs/heads/main@{#1508227}