[HitTest] Add culled inline ancestors of self-painting items to lists - #64131

A culled inline is an inline element, such as a plain <span>, that has
no box fragment of its own. BoxFragmentPainter::HitTestItemsChildren()
adds culled inline ancestors by calling HitTestCulledInlineAncestors()
after each item. It skips that call for items with a self-painting
layer, such as a position:relative child, because that layer is
hit-tested separately. The layer's own hit test never adds the culled
ancestors outside it, so nothing does.

For example, given

  <span id=a><span style="position:relative">Text</span></span>

document.elementsFromPoint() returns the inner span but not #a. WebKit
returns both, and CSSOM View says elementsFromPoint() returns every box
at the point, in paint order. #a is also missing at points on its own
text after such a child, such as "after" in

  <span id=a><span style="position:relative">Text</span>after</span>

because that text relies on its earlier sibling to add #a.

With this change, list-based hit tests let self-painting items fall
through to the existing culled inline check, as they already do for
other inline items.

DOM event targets are unaffected. Mouse, pointer, and gesture events get
their targets from single-point hit tests, which this change does not
touch. Those tests return the innermost element, and events bubble
normally through ancestor inlines. :hover and :active are set on every
ancestor of the hit element, so #a already matches them.

Bug: 576771254
Change-Id: I5c8c007bbbbebd39d6f9a7c6bb6d759f8e206171
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8642474
Commit-Queue: Aaron Leventhal <aleventhal@google.com>
Reviewed-by: Khushal Sagar <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1726041}