LibWeb: Make the paint tree a proper standalone tree

Until now, paint trees have been piggybacking on the layout tree for
traversal, and paintables didn't actually have their own parent/child
pointers.

This patch changes that by making Paintable inherit from TreeNode, and
adding a new pass to LayoutState::commit() where we recursively build
the new paint tree.

Userland/Libraries/LibWeb/Layout/LayoutState.h

@@ -148,7 +148,8 @@ struct LayoutState {
         Optional<Painting::PaintableBox::TableCellCoordinates> m_table_cell_coordinates;
     };
 
-    void commit();
+    // Commits the used values produced by layout and builds a paintable tree.
+    void commit(Box& root);
 
     // NOTE: get_mutable() will CoW the UsedValues if it's inherited from an ancestor state;
     UsedValues& get_mutable(NodeWithStyleAndBoxModelMetrics const&);