LibWeb: Mark image elements for layout before firing their load event

This removes a long-standing source of flakiness seen for example in
WPT's /referrer-policy/ tests.

(cherry picked from commit 063cd68bf472061ec35cf9b8970aa6e614632c9b)

Tests/LibWeb/Text/expected/HTML/img-metrics-in-load-event-handlers.txt

@@ -0,0 +1 @@
+image is 400x400

Tests/LibWeb/Text/input/HTML/img-metrics-in-load-event-handlers.html

@@ -0,0 +1,13 @@
+<script src="../include.js"></script>
+<script>
+    asyncTest((done) => {
+        let img = document.createElement("img");
+        img.src = "../../../Layout/input/400.png";
+        document.body.appendChild(img);
+        img.onload = function() {
+            println("image is " + img.clientWidth + "x" + img.clientHeight);
+            img.remove();
+            done();
+        };
+    });
+</script>

Userland/Libraries/LibWeb/HTML/HTMLImageElement.cpp

@@ -701,13 +701,13 @@ void HTMLImageElement::add_callbacks_to_image_request(JS::NonnullGCPtr<ImageRequ
                 // 3. Add the image to the list of available images using the key key, with the ignore higher-layer caching flag set.
                 document().list_of_available_images().add(key, *image_data, true);
 
+                set_needs_style_update(true);
+                document().set_needs_layout();
+
                 // 4. If maybe omit events is not set or previousURL is not equal to urlString, then fire an event named load at the img element.
                 if (!maybe_omit_events || previous_url != url_string)
                     dispatch_event(DOM::Event::create(realm(), HTML::EventNames::load));
 
-                set_needs_style_update(true);
-                document().set_needs_layout();
-
                 if (image_data->is_animated() && image_data->frame_count() > 1) {
                     m_current_frame_index = 0;
                     m_animation_timer->set_interval(image_data->frame_duration(0));