ie-html: improve scope checking and special element handling in tree builder

[thomasnemer]

Goal

Fix scope boundary checking and button/table special element behavior. Many tests fail because our scope checks are too simple.

Affected test files

• tests20.dat: 70% but failures are scope-related (button closing)
• tests16.dat: 14% (many scope-dependent tests)
• tests10.dat: 4% (scope edge cases)
• tests9.dat: 7%

Implementation needed

• Add missing scope boundaries: applet, marquee, object, template
• Fix button scope: `` inside `` should close the outer one
• Fix `
• ` implicit close behavior
• Fix `
  `/`
  ` implicit close behavior
• Proper handling of elements that close implicit `

  `

Estimated impact

+100-150 tests passing