Fix queryCommandValue("fontname") in Firefox.

Firefox often produces selection ranges that end in an ancestor
of the relevant formatting span, so selection.getNode (which is
based on commonAncestorContainer) skips past the formatting span
and the previous implementation misses it.

The new implementation mirrors the logic in formatter.match().