[soft navs] Introduce a Pre-Paint-based paint attribution mode

Currently, Soft Navigation paint attribution works as follows:
 1. If the DOM update is not "task attributable", do nothing
 2. When a connected DOM node is modified (currently only appended, but
    that will change soon), we add it to a set of nodes to do paint
    attribution for
 3. When painting contentful elements:
   a) (enabled-by-default): Check if the node is in the set for some
      context, and attribute the paint if so
   b) (experimental): Walk up the DOM tree to see if any ancestor is
      in the set, and attribute the paint if so

3(a) is the default, but it is not viable because it's inaccurate (we'd
need to consider disconnected nodes as well, which is too inefficient)

3(b) is more accurate, but there are efficiency concerns due to the
tree walk during paint. This also might limit which input events we can
do attribution for, which limits future metrics.

This CL introduces a new experimental option, which caches the state
needed for determining attribution in a pre-paint tree walk:
 - When the SoftNavigationContext for a node changes, mark a bit on
   LayoutObject indicating that this node has change, and update
   ancestors indicating a descendant has changed. True by default in the
   case the LayoutObject doesn't change (often true for soft navs, due
   to append()).
 - In pre-paint, if a node is being marked as changed, the context for
   the node is determined to either be the parent (if inheriting) or the
   node is a new "container root", with a different context. (tracked by
   SoftNavigationPaintAttributionTracker)
   - If inheriting, a ShouldInheritSoftNavigationContext bit gets set,
     which is used for subsequent walks
   - If not inheriting, the node being visited is a new container root,
     associated with a different context, and that root is passed down
     to children.

Initially, everything is wired up to inherit a null context.

SoftNavigationPaintAttributionTracker maintains a map of (weak) Node to
NodeState, which is the SNC and a couple other bits. To improve memory
efficiency, it only tracks the Nodes it needs to do attribution, which
are:
 - Nodes that were directly modified (e.g. appended, which could be a
   whole subtree)
 - Text aggregation nodes (closest non-anonymous box ancestor of a text
   node), which is what the paint functions see
 - Images (svg, video, images, and background images)

See comments in SoftNavigationPaintAttributionTracker for more details.

Bug: 423670827
Change-Id: I082b1a3e3b66e30edb8b08b50b4e6c1c8bd975fc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6629428
Commit-Queue: Scott Haseley <shaseley@chromium.org>
Reviewed-by: Johannes Henkel <johannes@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1476843}