CSS Parser: Fix use after free resulting from CSSParserValueList::extend()

CSSParserValueLists can contain pointers and are responsible for freeing
them in their destructor.
This patch prevents sharing of pointers between different
CSSParserValueLists to avoid multiple frees of shared pointers. This is
achieved by changing extend() to stealValues() so items are moved between
lists instead of copied.

BUG=340001
R=eseidel@chromium.org, mikelawther@chromium.org

Review URL: https://codereview.chromium.org/157363004

git-svn-id: svn://svn.chromium.org/blink/trunk@166883 bbb929c8-8fbe-4397-9dbb-9b2b20218538