LibWeb: Always flush character insertions before exiting HTML parser

This fixes an issue where document.write() with only text input would
leave all the character data as unflushed text in the parser.

This fixes many of the WPT tests for document.write().

Tests/LibWeb/Text/expected/HTML/document-write-flush-character-insertions.txt

@@ -0,0 +1 @@
+PASS

Tests/LibWeb/Text/input/HTML/document-write-flush-character-insertions.html

@@ -0,0 +1,6 @@
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        document.write("PASS");
+    });
+</script>