LibWeb: Protect RadioButton and TextNode against mutating DOM

RadioButton had some protection, but also needed to be protected against
click events originating from its associated label.

Userland/Libraries/LibWeb/Layout/RadioButton.cpp

@@ -115,6 +115,9 @@ void RadioButton::handle_associated_label_mousedown(Badge<Label>)
 
 void RadioButton::handle_associated_label_mouseup(Badge<Label>)
 {
+    // NOTE: Changing the checked state of the DOM node may run arbitrary JS, which could disappear this node.
+    NonnullRefPtr protect = *this;
+
     set_checked_within_group();
     m_being_pressed = false;
 }

Userland/Libraries/LibWeb/Layout/TextNode.cpp

@@ -324,6 +324,10 @@ void TextNode::handle_mouseup(Badge<EventHandler>, const Gfx::IntPoint& position
 {
     if (!parent() || !is<Label>(*parent()))
         return;
+
+    // NOTE: Changing the state of the DOM node may run arbitrary JS, which could disappear this node.
+    NonnullRefPtr protect = *this;
+
     downcast<Label>(*parent()).handle_mouseup_on_label({}, position, button);
     frame().event_handler().set_mouse_event_tracking_layout_node(nullptr);
 }