Fix crash when encountered unmatched script end-tag token in TextMode

Before this CL, we assumed that <script> start-tag was seen when we
encounter <script> end-tag token when the parser insertion mode is in
'text' mode.

However, the <script> end-tag may also appear w/o script tag in
"the stack of open elements", like in attached test.

BUG=411226

Review-Url: https://codereview.chromium.org/2151783002
Cr-Commit-Position: refs/heads/master@{#406770}
3 files changed