LibWeb: Do paint-order traversal in Document::elements_from_point()

Elements are now collected according to paint order as spec says,
replacing the depth-first traversal of the paint tree with hit-testing
on each box.

This change resolves a FIXME in an existing test and adds a new
previously non-working test.

Tests/LibWeb/Text/input/DOM/Elements-from-point-3.html

@@ -0,0 +1,18 @@
+<div>
+    <p>Some text</p>
+</div>
+<p>Elements at point 30, 20:</p>
+<div id="output"></div>
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        let output = document.getElementById("output");
+        let elements = document.elementsFromPoint(30, 20);
+        elements.forEach((elt, i) => {
+            output.textContent += elt.localName;
+            if (i < elements.length - 1) {
+                output.textContent += " < ";
+            }
+        });
+    });
+</script>