WEBKIT_DISABLE_DMABUF_RENDERER crashes WebKitGTK on NVIDIA instead of falling back to shared memory

`webkit_rendering.rs` sets `WEBKIT_DISABLE_DMABUF_RENDERER=1` on NVIDIA GPUs and on AppImage packaging to avoid the #2338 startup abort, with the stated intent of falling back to the shared-memory buffer path.

On current WebKitGTK that variable no longer falls back. It returns before `mode.add(RendererBufferTransportMode::SharedMemory)`, so the transport mode is left empty, `AcceleratedBackingStore::create()` returns nullptr, and `webkitWebViewBaseEnterAcceleratedCompositingMode()` dereferences it, guarded only by an `ASSERT`, which is compiled out in release builds. The app SIGSEGVs the first time content needs a compositing layer. Switching workspaces does it every time.

```
#0 AcceleratedBackingStore::update() AcceleratedBackingStore.cpp:808
#1 WebPageProxy::enterAcceleratedCompositingMode()
#2 DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode()
<- IPC Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode
```

Measured in the failing process: transport mode `0x00000000`, `create()` returned `0x0`, and `priv->acceleratedBackingStore` is NULL in the core dump. The webview is never disposed (breakpoint on `webkitWebViewBaseDispose` never fires), so the pointer is null from creation rather than from teardown.

`WEBKIT_DMABUF_RENDERER_FORCE_SHM=1` returns *after* SharedMemory is added. That is the documented intent, no hardware dmabuf path, and it leaves the backing store valid.

## Verification

Ubuntu 24.04, WebKitGTK 2.52.3, GeForce RTX 3050 Ti (driver 580.173.02), X11.

| build | module log line | workspace switch |
| --- | --- | --- |
| 0.4.24 AppImage (ships `DISABLE_DMABUF`) | `WEBKIT_DISABLE_DMABUF_RENDERER=1 — NVIDIA GPU, AppImage` | SIGSEGV |
| `main` with `HEURISTIC = [FORCE_SHM]` | `WEBKIT_DMABUF_RENDERER_FORCE_SHM=1 — NVIDIA GPU` | works |

Same result running the AppImage with the two variables set by hand, so the variable is the only difference and not the build.

Both runs pin EGL to Mesa (`__EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json`). Debian and Ubuntu ship `disable-nvidia-dmabuf.patch` in webkit2gtk, which empties the same transport mode on NVIDIA regardless of this variable; without the pin that patch masks the difference. It also means this change alone will not fix Debian/Ubuntu users. I am reporting that to Debian separately.

## Not verified

Whether `FORCE_SHM` still avoids the #2338 abort. I do not have hardware that reproduces #2338, and that is the reason the setting exists, so it is worth confirming before changing it.

If the swap looks right I am happy to send the PR. The module's unit tests pin the current variable, so they would need updating too, and `OWNED` would need a decision: adding `FORCE_SHM` keeps the "everything this module may set" invariant, but changes which user assignments make it stand down.

Start in webkit_rendering.rs by tracing the DISABLE_DMABUF and FORCE_SHM handling, then run the module's unit tests that pin the current variable. Confirm whether FORCE_SHM avoids the reported crash before changing the heuristic, update the tests, and resolve how OWNED should treat user assignments.

Written by the indexing model from the issue text.