68516a66b91d57e35aa99cb1c91df195f5be44b4  [Safer CPP] Address more uncounted arg warnings

Classified as not security-relevant.
Triage note: Bulk AXObjectCache SaferCPP sweep wrapping get()/document()/node arguments in protect() and hoisting Ref locals, plus platform-scoping of UncheckedCallArgs/UncountedCallArgs expectation entries; a static-analyzer-driven migration with no identified bug (explicitly a false-positive pattern).
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.

Structural signals: smartptr_member_added (+6.47), bounds_guard (+2.0), null_guard (+2.59), area:Source/WebCore/html (+2.0), large_churn (-2.0)