LibWeb: Special case SVG masks during layout

Rather than try to lay out masks normally, this updates the TreeBuilder
to create layout nodes for masks as a child of their user (i.e. the
masked element). This allows each use of a mask to be laid out
differently, which makes supporting `maskContentUnits=objectBoundingBox`
fairly easy.

The `SVGFormattingContext` is then updated to lay out masks last (as
their sizing may depend on their parent), and treats them like
viewports.

This is pretty ad-hoc, but the SVG specification does not give any
guidance on how to actually implement this.

Userland/Libraries/LibWeb/Painting/SVGMaskPaintable.cpp

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024, MacDue <macdue@dueutil.tech>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <LibWeb/Painting/SVGMaskPaintable.h>
+
+namespace Web::Painting {
+
+JS::NonnullGCPtr<SVGMaskPaintable> SVGMaskPaintable::create(Layout::SVGMaskBox const& layout_box)
+{
+    return layout_box.heap().allocate_without_realm<SVGMaskPaintable>(layout_box);
+}
+
+SVGMaskPaintable::SVGMaskPaintable(Layout::SVGMaskBox const& layout_box)
+    : SVGGraphicsPaintable(layout_box)
+{
+}
+
+}