LibWeb: Correct logic for removing end nodes from HTMLOptionsCollection

This test case would previously crash.

Found with domato.

Tests/LibWeb/Text/expected/DOM/HTMLSelectElement-length.txt

@@ -0,0 +1,3 @@
+0
+1
+0

Tests/LibWeb/Text/input/DOM/HTMLSelectElement-length.html

@@ -0,0 +1,12 @@
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        const select = document.createElement("select");
+        const option = document.createElement("option");
+        println(select.length);
+        select.add(option);
+        println(select.length);
+        select.length = 0;
+        println(select.length);
+    });
+</script>

Userland/Libraries/LibWeb/HTML/HTMLOptionsCollection.cpp

@@ -66,8 +66,8 @@ WebIDL::ExceptionOr<void> HTMLOptionsCollection::set_length(WebIDL::UnsignedLong
         auto n = current - value;
 
         // 3.2. Remove the last n nodes in the collection from their parent nodes.
-        for (WebIDL::UnsignedLong i = current - 1; i >= current - n; i--)
+        for (auto i = 0u; i < n; i++)
-            this->item(i)->remove();
+            item(length() - 1)->remove();
     }
 
     return {};