ANGLE Metal — Cross-Origin URL Leak

Leaks GPU process heap to JavaScript via stale ANGLE texture views. The GPU process composites all tabs — URL strings from other origins appear in its heap and are readable by any WebGL2 page. Works on both pre-fix and post-fix ANGLE builds.