IndexedDB: Fix crash in ~IDBRequest and ~IDBCursor.

IDBRequest::m_transaction can be destructed before the IDBRequest object.
We can't dereference it in ~IDBRequest.

We apply the weak HashMap pattern to call handleBlobAcks() before destructing
IDBRequest::m_transaction. In this case, we need to be careful to avoid the
HashMap is not destructed with the IDBRequest object, and the HashMap is a
per-thread object.

IDBPendingTransactionMonitor is an existing per-thread object in
modules/indexeddb/.  So it should be responsible to handle the weak HashMap.
IDBPendingTransactionMonitor can't have it because an
IDBPendingTransactionMonitor object is destructed before thread cleanup GC.
So we introduce new RefCounted object to own the weak HashMap.

IDBCursor had a problem same as IDBRequest.

This CL has no tests. The bug depends on memory layout, and there is no way to  
make reliable tests.

BUG=417362

Review URL: https://codereview.chromium.org/610543002

git-svn-id: svn://svn.chromium.org/blink/trunk@183118 bbb929c8-8fbe-4397-9dbb-9b2b20218538