Fix use-after-move in NGOffsetMapping

Fix a user-after-move issue in a debug/security assertion in
NGOffsetMapping, as found by clang-tidy:

  third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping.cc:276:
  'ranges' used after it was moved
  third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping.cc:267:
  move occurred here

Bug: 1122844
Change-Id: I72b622aab1caa523d22caec953b33de8bdc155ef
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3337036


Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Auto-Submit: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#958141}