Fix UAF in GetAttrSubstitutionValue
CSSParserTokenStream needs to stay alive until the CSSParserToken is
appended to out TokenSequence, since CSSParserToken is holding a
reference to CSSParserTokenStream.
Bug: 365802556
Change-Id: Ic3f5a5277d5ab754630eb26fad120f217dab2ea2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5853990
Reviewed-by: Anders Hartvoll Ruud andruud@chromium.org
Commit-Queue: Munira Tursunova moonira@google.com
Cr-Commit-Position: refs/heads/main@{#1355099}