LibWeb: Stop parsing after document.write at the insertion point

If a call to `document.write` inserts an incomplete HTML tag, e.g.:

    document.write("<p");

we would previously continue parsing the document until we reached a
closing angle bracket. However, the spec states we should stop once we
reach the new insertion point.

Tests/LibWeb/Layout/input/document-write-incomplete-tag.html

@@ -0,0 +1,8 @@
+<p>Well</p>
+
+<script type="text/javascript">
+    document.write("<p");
+    document.write(">hello</p>");
+</script>
+
+<p>friends!</p>