Fix bad cast to XPath::Filter in XPathGrammar.y

In XPathGrammar.y, we cast the Expression to Filter before passing it to the
Path constructor. This is wrong as the Expression is not necessarily of type
XPath::Filter. For example, in fast/xpath/id-simple.html, it has type
XPath::Function.

I noticed this bug when marking the XPath::Filter class as FINAL. The
fast/xpath/id-simple.html test started crashing as the call to
Filter::evaluate() was resolved at compile time instead of using the vtable at
runtime. Since the object is actually a XPath::Function and not a XPath::Filter
in this test, this was causing trouble.
BUG=333155
R=abarth, esprehn

Review URL: https://codereview.chromium.org/131593003

git-svn-id: svn://svn.chromium.org/blink/trunk@164845 bbb929c8-8fbe-4397-9dbb-9b2b20218538