QSvgHandler: make clear when document() ownership is transferred

Previously, QSvgHandler assumed that someone would call document() and
assume ownership of the QSvgDocument. As a result, while QSvgHandler
deleted the document in error cases (potentially causing earlier
callers of document() that held on to the pointer to dangle), it
didn't in its destructor.

As a direct consequence, if nobody took ownership of document() before
~QSvgHandler() runs, the document was leaked. That this is not just a
theoretical issue was shown by tst_QSvgHandler itself (of all cases),
where testCreateAnimateTransformNode() didn't take ownership, and
therefore produced leaks.

As a fix, make QSvgHandler own the QSvgDocument and document() just
observe the stored object. Add a new function, takeDocument(), which
actually transfers ownership of the document to the caller, resetting
QSvgHandler::m_doc, so any further use doesn't use a potentially
dangling pointer.

This fixes the remaining asan-reported leaks in tst_QSvgHandler.

Amends the start of the public history.

Pick-to: 6.12 6.11 6.8
Change-Id: I1b207378ba1fec0d355f0bbce5376de4c5c4ed65
Reviewed-by: Robert Löhning <robert.loehning@qt.io>