LibWeb: Fix memory leak in CSS::ImageStyleValue

Before this change, whenever ImageStyleValue had a non-null
`m_image_request`, it was always leaked along with everything related
to the document to which this value belongs. The issue arises due to
the use of `JS::Handle` for the image request, as it introduces a
cyclic dependency where `ImageRequest` prevents the `CSSStyleSheet`,
that owns `ImageStyleValue`, from being deallocated:
- ImageRequest
- FetchController
- FetchParams
- Window
- HTMLDocument
- HTMLHtmlElement
- HTMLBodyElement
- Text
- HTMLHeadElement
- Text
- HTMLMetaElement
- Text
- HTMLTitleElement
- Text
- HTMLStyleElement
- CSSStyleSheet

This change solves this by visiting `m_image_request` from
`visit_edges` instead of introducing new heap root by using
`JS::Handle`.

Userland/Libraries/LibWeb/CSS/StyleValues/ImageStyleValue.h

@@ -10,9 +10,11 @@
 #pragma once
 
 #include <AK/URL.h>
+#include <LibJS/Heap/Cell.h>
 #include <LibJS/Heap/Handle.h>
 #include <LibWeb/CSS/Enums.h>
 #include <LibWeb/CSS/StyleValues/AbstractImageStyleValue.h>
+#include <LibWeb/HTML/SharedImageRequest.h>
 
 namespace Web::CSS {
 
@@ -26,6 +28,13 @@ public:
     }
     virtual ~ImageStyleValue() override = default;
 
+    void visit_edges(JS::Cell::Visitor& visitor) const
+    {
+        // FIXME: visit_edges in non-GC allocated classes is confusing pattern.
+        //        Consider making StyleValue to be GC allocated instead.
+        visitor.visit(m_image_request);
+    }
+
     virtual String to_string() const override;
     virtual bool equals(StyleValue const& other) const override;
 
@@ -44,7 +53,7 @@ public:
 private:
     ImageStyleValue(AK::URL const&);
 
-    JS::Handle<HTML::SharedImageRequest> m_image_request;
+    JS::GCPtr<HTML::SharedImageRequest> m_image_request;
 
     void animate();
     Gfx::Bitmap const* bitmap(size_t frame_index, Gfx::IntSize = {}) const;