script: Clamp table spans according to the HTML specification (#36703)

Previously, spans were partially clamped during layout, but this means
that accessing and setting these properties via script wouldn't behave
according to the HTML specification. In addition, the value wasn't
floored in layout, so could lead to panics. This change improves
clamping and moves it to script.
    
Testing: This change includes a new WPT test.
Fixes #36699.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>

tests/wpt/meta/MANIFEST.json

@@ -4916,6 +4916,13 @@
        {}
       ]
      ],
+     "colspan-zero-crash.html": [
+      "a50586a5bfa7551724b838a0438339a34b4930fb",
+      [
+       null,
+       {}
+      ]
+     ],
      "crashtests": {
       "caption-repaint-crash.html": [
        "6a024d0c1d7ef58da06a489d80d187bcb2a3e350",
@@ -739709,14 +739716,14 @@
       ],
       "processing-model-1": {
        "col-span-limits.html": [
-        "a4a425b9c1f70926c77ad3eb1b8a8a87a4655de9",
+        "2a1ac80e65ad37a0e15ca383e67889b79f2308d0",
         [
          null,
          {}
         ]
        ],
        "span-limits.html": [
-        "cdfa61bbcdc06ea62b80d042440d55fb0c89a186",
+        "798639b387562a54965d5283673a50773c2a3c49",
         [
          null,
          {