Oilpan: Prepare to move FormController and DocumentState to Oilpan heap, and remove RefPtrs to HTMLFormControlElement and HTMLFormControlElementWithState.

Note: ValidationMessage has a raw pointer member to HTMLFormControlElement. This
CL doesn't make it traceable because a CL to remove ValidationMessage class is
in-progress. A ValidationMessage object is owned by the HTMLFormControlElement
object and the raw pointer is safe.

BUG=357163

Review URL: https://codereview.chromium.org/277753003

git-svn-id: svn://svn.chromium.org/blink/trunk@173710 bbb929c8-8fbe-4397-9dbb-9b2b20218538