Avoid reaching for StyleResolver::m_features from StyleBuilder.

In order to inform style invalidation machinery, we have to keep track
of all styles that depend on DOM state. This bookkeeping is provided
by RuleFeatureSet, which is unfortunately hosted on StyleResolver.

This means that whenever we apply a "content: attr(foo)" property,
we must reach for m_features and add stuff to it.

This change avoids direct reaching by accumulating values on StyleResolverState.

No change in behavior, so no tests.

BUG=259085
R=eae, eseidel, esprehn

Review URL: https://chromiumcodereview.appspot.com/20672003

git-svn-id: svn://svn.chromium.org/blink/trunk@155382 bbb929c8-8fbe-4397-9dbb-9b2b20218538