Bug 1685078 - Support full <image> syntax in list-style-image as per spec. r=jrmuizel,TYLin

This allows supporting image-set(), etc, and simplifies the bullet frame
code significantly, too thanks to two changes:

  * Instead of manually managing the image request, use the CSS image
    loader, with the `REQUEST_REQUIRES_REFLOW` flag, to handle image
    loads correctly. This didn't exist when this code was initially
    implemented, but we can nicely use it now.

  * Instead of re-implementing another WebRender command-builder thing,
    we can just reuse the nsImageRenderer code.

Differential Revision: https://phabricator.services.mozilla.com/D100774

layout/xul/tree/nsTreeBodyFrame.cpp

@@ -1862,7 +1862,8 @@ nsresult nsTreeBodyFrame::GetImage(int32_t aRowIndex, nsTreeColumn* aCol,
   } else {
     // Obtain the URL from the ComputedStyle.
     aAllowImageRegions = true;
-    styleRequest = aComputedStyle->StyleList()->GetListStyleImage();
+    styleRequest =
+        aComputedStyle->StyleList()->mListStyleImage.GetImageRequest();
     if (!styleRequest) return NS_OK;
     nsCOMPtr<nsIURI> uri;
     styleRequest->GetURI(getter_AddRefs(uri));