[css-pseudo] Implement LayoutNG normal markers as real pseudo-elements

Before this patch, list markers were only pseudo-elements when 'content'
was different than 'normal'. Otherwise they were anonymous boxes.
This makes them be pseudo-elements in that case too.

This only affects LayoutNG, in legacy they continue being anonymous.

BUG=457718

TEST=accessibility/aria-owns-sends-notification.html
TEST=editing/selection/drag-to-contenteditable-iframe.html
TEST=editing/selection/selectNode.html
TEST=editing/selection/selectNodeContents.html
TEST=external/wpt/css/css-pseudo/marker-computed-size.html
TEST=external/wpt/css/css-pseudo/marker-content-014.html
TEST=blink_unittests --gtest_filter=NGInlineCursorTest/NGInlineCursorTest.NextWithListItem/*
TEST=blink_unittests --gtest_filter=ParameterizedTextPaintTimingDetectorTest.CapturingListMarkers/*
TEST=content_browsertests --gtest_filter=All/DumpAccessibilityTreeTest.AccessibilityLi/*

marker-content-014.html still fails in legacy since markers are not
pseudo-elements yet.

marker-computed-size.html also fails in legacy, and one of the subcases
fails in LayoutNG since 'content: none' doesn't work yet in ::marker.

fast/multicol/span/list-multi-column-crash.html now crashes with
LayoutNGBlockFragmentation enabled due to bug 1040947. The crash was
already happening with ::before and ::after, so it's expected.

Change-Id: I51d9661f32b2e1c0c392c261853f8127b74136fe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1985952
Commit-Queue: Oriol Brufau <obrufau@igalia.com>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#731964}
35 files changed