Return scoped_refptr from PrefetchNetworkContext::GetURLLoaderFactory()

This CL makes `PrefetchNetworkContext::GetURLLoaderFactory()` return
`scoped_refptr<network::SharedURLLoaderFactory>` instead of a raw
pointer, to allow the factory plumbed across tasks asynchronously without passing raw pointers. After https://chromium-review.googlesource.com/c/chromium/src/+/6228199, the URLLoaderFactory can be used after asynchronous ServiceWorker check.

Alternatively, we could call `PrefetchNetworkContext::GetURLLoaderFactory()` when the factory is needed (after ServiceWorker check), but instead we first call `GetURLLoaderFactory()` and then plumb the `scoped_refptr<network::SharedURLLoaderFactory>` asynchronously, to decouple the user of the factory (in `PrefetchStreamingURLLoader`) from its original owner (`PrefetchNetworkContext`).
https://docs.google.com/document/d/1kbs8YJuh93F_K6JqW84YSsjVWcAeU41Mj9nwPr6IXRs/edit?tab=t.0#bookmark=id.kohs7htfumek

This (and the subsequent CL) might extend the lifetime of the returned
URLLoaderFactory a little, but probably it's OK because the
URLLoaderFactory still doesn't outlive `PrefetchStreamingURLLoader`.

Bug: 40947546
Change-Id: I51fc017c9723760fe43881710574dfea3a0dc129
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6177744
Reviewed-by: Ken Okada <kenoss@chromium.org>
Reviewed-by: Taiyo Mizuhashi <taiyo@chromium.org>
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1428015}