chore: cherry-pick 43 changes from angle, chromium, libaom, libvpx, pdfium, skia, v8 and webrtc - #55515

Description of Change

Backports the following changes:

• 64b22df8fc3b from angle — Metal: Handle non-OOM command buffer errors
• 974b79ad146a from angle — Metal: Fix 2D array layer count check in TextureMtl::redefineImage
• 041491e936ea from chromium — views: Defer MenuRunnerImpl destruction when released in OnMenuClosed
• 115f38332946 from chromium — Fix CopyOutputRequest check with OffsetTags
• 6563f89211c4 from chromium — [CE]Prevent crash when frame is detached during capability element registration
• 25df6183505d from chromium — Do not reuse non-CORS StyleImage data with a CORS request
• 270d5d328add from chromium — Make timed elements inserted into shadow trees inert
• 278621c8ed4f from chromium — [Editing] Copy id attribute when undoing a split
• 30e4d30f53b3 from chromium — Fix ImageContext thread safety
• 32c2e2f4faf5 from chromium — Copy ListedElements before iterating in ConstructEntryList
• cd4327123733 from chromium — [M150-LTS] [FSA] Prevent synchronous lock promotion UAF during manager teardown
• 4a0ef6be08f4 from chromium — Disable FEDisplacementMap acting as a backdrop-filter
• 5173a94262b6 from chromium — [layout] Add move constructor and assignment operator to Shelf.
• 540347fff68c from chromium — [webvtt] Make text-track pseudo-elements read-only
• 547eca8b5a33 from chromium — Change ImageContext access failure
• 6438ea41e253 from chromium — Defer entry removal until database scan iterator is destroyed
• 7097f7405ec7 from chromium — Update animation when setting currentTime with null timeline
• 136b3f96d168 from chromium — [M150-LTS] Avoid UAFs in BlobStorageContext
• 72bc9fdbbe98 from chromium — views: Deduplicate deferred destruction in MenuRunnerImpl::OnMenuClosed
• 8b782807c92e from chromium — media: Fix UAF when MojoCdm is destroyed during OnConnectionError
• adb8ef84f8fe from chromium — blink: Fix ImageCaptureFrameGrabber UAF in OnVideoFrame
• b2cf613aec98 from chromium — Fix lint in 'DatabaseCheckHelper::ScanDirectory'.
• beee6bb7ce5b from chromium — Ensure gradient data pointers remain safe to use
• c26b38a137c5 from chromium — [WebAudio] Stop paused destination and guard automatic pull on close
• db073cce765d from chromium — Forbid modifying weak LinkedHashSet during iteration
• de1ff16679be from chromium — Harden PersistentSystemProfile against corrupt segment sizes
• e0cb253a6f79 from chromium — Disable FEDisplacementMap for animated CSS backdrop-filter
• eda3f57fe1a0 from chromium — [HLS] Disallow file:// HLS content
• ef5adf65e8dc from chromium — HttpCache: prevent lock timeout overtaking explicit restart
• f49d058c8801 from chromium — Limit image request in HTMLPlugInElement::CustomStyleForLayoutObject
• a01bb1dddef8 from libaom — rtc: Clamp forced NEWMV vectors in handle_inter_mode_nonrd
• ed2a5b572f0f from libvpx — vp8: clear cached resolution on thread restart failure
• 0a42f6e64f28 from pdfium — Improve memory allocation failure handling in OpenJPEG
• 039111f16287 from skia — [Ganesh] Ref resource in GrResourceCache when switching UniqueKey
• 0ef44edd0ec4 from skia — [SkSL:RP] Prevent slot count overflow in Raster Pipeline codegen
• 870022992359 from skia — [skif] Update SkImageFilter_Base uniqueID to 64-bit
• ca5696a110e8 from skia — [Vulkan] Treat VK_ERROR_UNKNOWN as VK_ERROR_DEVICE_LOST
• 11a31ce52ce0 from v8 — [wasm] Scan outgoing stack parameters from Wasm to builtins
• 5a4d7a78dbb4 from v8 — [maps] Synchronize concurrent GetPrototypeTransition in TryUpdateNoLock
• d4374eaec817 from v8 — [M156] [turbofan] Emit dedicated operator for trusted-pointer loads
• c713c92ce08f from v8 — [maglev] Validate alternative type checks before reusing conversions
• f2df0f7686ef from v8 — [maglev] Preserve number checks when untagging HoleyFloat64
• d86ac8ab5e04 from webrtc — Fail EncodeFec when packets are passed radically out of order

Checklist

• I have filled out the PR description
• I have reviewed and verified the changes

Release Notes

Notes: Backported fixes from upstream ANGLE, Chromium, libaom, libvpx, PDFium, Skia, V8 and WebRTC.