accessiblity: AXObjectCacheImpl: Clear mojo receiver

PermissionObserver kept receiving messages after the object was
considered dead (and thus being poisoned) by the garbage collector.

Actual destruction of the object is deferred which means the receiver
should be cleared on Dispose.

Bug: 991085
Change-Id: I701dfa9aad19b30b95cc42f00195668c33393a96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1743727Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#685485}

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -140,6 +140,8 @@ void AXObjectCacheImpl::Dispose() {
     document->View()->UnregisterFromLifecycleNotifications(this);
   }
 
+  permission_observer_receiver_.reset();
+
 #if DCHECK_IS_ON()
   has_been_disposed_ = true;
 #endif