01d5ae3487dffe63a132aedeca5c53e8e6e3be76  [HTML-in-Canvas] Allow drawing the canvas children to DisplayLists when layoutsubtree present

Classified as not security-relevant.
Triage note: Replaces NotSupportedError stubs with real drawElementImage/drawSnapshot/drawableElementSnapshot implementations and a snapshot recorder map; this is net-new HTML-in-canvas feature work, not a fix to an existing bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.

Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), area:Source/WebCore/html (+2.0), large_churn (-2.0)