chore: cherry-pick 94a8bdafc8c6 from chromium

[nornagon]

Fix use-after-free vulnerability in ComboboxModel

Stop the Combobox from observing the model when the model gets
destroyed. This is done by adding a virtual OnComboboxModelDestroying()
to the base observer class and calling it in ~ComboboxModel().

This fix will prevent the use-after-free that happens when the combobox outlives the model, usually because the model lifetime
is managed by non-UI component.

Bug: 1264288
Change-Id: Ia00881a9b674bbc83bbf54dd228490c1cc1290bc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3693825
Commit-Queue: Keren Zhu kerenzhu@chromium.org
Reviewed-by: Matthias Körber koerber@google.com
Auto-Submit: Keren Zhu kerenzhu@chromium.org
Reviewed-by: Peter Boström pbos@chromium.org
Cr-Commit-Position: refs/heads/main@{#1012504}

Notes: Security: backported fix for 1264288.

[release-clerk]

Release Notes Persisted

Security: backported fix for 1264288.