LibWeb: Special case SVG masks during layout

Rather than try to lay out masks normally, this updates the TreeBuilder
to create layout nodes for masks as a child of their user (i.e. the
masked element). This allows each use of a mask to be laid out
differently, which makes supporting `maskContentUnits=objectBoundingBox`
fairly easy.

The `SVGFormattingContext` is then updated to lay out masks last (as
their sizing may depend on their parent), and treats them like
viewports.

This is pretty ad-hoc, but the SVG specification does not give any
guidance on how to actually implement this.

Userland/Libraries/LibWeb/Painting/SVGMaskPaintable.h

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2024, MacDue <macdue@dueutil.tech>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#pragma once
+
+#include <LibWeb/Layout/SVGMaskBox.h>
+#include <LibWeb/Painting/SVGGraphicsPaintable.h>
+
+namespace Web::Painting {
+
+class SVGMaskPaintable : public SVGGraphicsPaintable {
+    JS_CELL(SVGMaskPaintable, SVGGraphicsPaintable);
+
+public:
+    static JS::NonnullGCPtr<SVGMaskPaintable> create(Layout::SVGMaskBox const&);
+
+    bool forms_unconnected_subtree() const override
+    {
+        // Masks should not be painted (i.e. reachable) unless referenced by another element.
+        return true;
+    }
+
+protected:
+    SVGMaskPaintable(Layout::SVGMaskBox const&);
+};
+
+}