chore: cherry-pick 999cc7185e93 and 0f0b3a54c53c from chromium

[ppontes]

[M108-LTS] Simplify WebMediaPlayerMSCompositor destruction.

The code was only sometimes calling StopUsingProvider() and posted
the submitter destruction unnecessarily.

Destruction now works the same as in VideoFrameCompositor, where the
class itself is responsible for calling StopUsingProvider() during
its own destruction.

(cherry picked from commit cbd238e85903b7d94910bd2c6362ff9abf9908cc)

Fixed: 1407701
Disallow-Recycled-Builds: test-failures
Change-Id: Ia649cb5532519468eea34e12745ed9c990580d82
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4195824
Auto-Submit: Dale Curtis dalecurtis@chromium.org
Commit-Queue: Tony Herre toprice@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#1098505}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4225498
Reviewed-by: Oleh Lamzin lamzin@google.com
Owners-Override: Oleh Lamzin lamzin@google.com
Commit-Queue: Roger Felipe Zanoni da Silva rzanoni@google.com
Cr-Commit-Position: refs/branch-heads/5359@{#1391}
Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933}

================================

[M108-LTS] Further simplify WebMediaPlayerMSCompositor lifetime.

M108 merge issues:
third_party/blink/renderer/modules/mediastream/webmediaplayer_ms.cc:
- video_task_runner_ is named io_task_runner_ in 108

third_party/blink/renderer/modules/mediastream/webmediaplayer_ms_compositor.cc:
- video_task_runner_ is named io_task_runner_ in 108 (conflict in ReplaceCurrentFrameWithACopy)

Due to the raw pointer held by VideoFrameSubmitter, there may be
tasks pending on the compositor task runner after the RefCounted
traits have "destructed" WebMediaPlayerMSCompositor. Through this
raw pointer VFS was invoking OnContextLost which attempts to use
the zero ref count compositor.

The solution here is again similar to VideoFrameCompositor, its
destruction should be explicit instead of a tangle of RefCounted
owners.

(cherry picked from commit 1622bffc6534a0cc4f53d07c43e0cd8f49975d10)

Fixed: 1407701, 1411601
Change-Id: Ic77294d1113d54ab83bc0f5b625a997edf57bf7c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4210508
Commit-Queue: Tony Herre toprice@chromium.org
Auto-Submit: Dale Curtis dalecurtis@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#1099726}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4225393
Commit-Queue: Roger Felipe Zanoni da Silva rzanoni@google.com
Reviewed-by: Oleh Lamzin lamzin@google.com
Owners-Override: Oleh Lamzin lamzin@google.com
Cr-Commit-Position: refs/branch-heads/5359@{#1392}
Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933}

Ref electron/security#282

Notes: Security: backported fix for CVE-2023-0931.

[release-clerk]

Release Notes Persisted

Security: backported fix for CVE-2023-0931.