layout: Floor the max-content size by the min-content size (#36518)

It's typically a given that the min-content size can't exceed the
max-content size. However, it was possible to break that assumption when
an inline formatting context had contents with a negative outer size
(due to margins). This could lead to assert failures.

This patch avoids the problem by flooring the max-content size to not be
smaller than the min-content size. Note there is no interoperability:
https://github.com/w3c/csswg-drafts/issues/12076

Testing: adding new reftest and crashtest
Fixes: #36481

Signed-off-by: Oriol Brufau <obrufau@igalia.com>

tests/wpt/meta/MANIFEST.json

@@ -4901,6 +4901,13 @@
         {}
        ]
       ],
+      "cell-contents-with-negative-outer-size.html": [
+       "c9cd275ad9e07fa33fa4c8ac363b891562628614",
+       [
+        null,
+        {}
+       ]
+      ],
       "col_span_dynamic_crash.html": [
        "67630066fad440e64f901512622cbaabdc4af370",
        [
@@ -249543,6 +249550,19 @@
        {}
       ]
      ],
+     "min-content-le-max-content.tentative.html": [
+      "81bc6969d50cd57e33b0268bc26bec6ec42ea6a9",
+      [
+       null,
+       [
+        [
+         "/css/reference/ref-filled-green-100px-square.xht",
+         "=="
+        ]
+       ],
+       {}
+      ]
+     ],
      "min-content-min-width-000.html": [
       "9dff1b973477b15b1118787e4ad5d213abfb6809",
       [