UIA problem with elements inside text templates

* .NET Core Version: 6.0.5
* Windows version: Win 10 21H2
* Does the bug reproduce also in WPF for .NET Framework 4.8?: Yes
* Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc...)? No
* Security issues and bugs should be reported privately, learn more via our [responsible disclosure guidelines](https://github.com/dotnet/wpf/blob/main/README.md#reporting-security-issues-and-security-bugs).

**Problem description:**
This was originally reported as https://github.com/microsoft/accessibility-insights-windows/issues/1334. After investigation, we determined that when a ControlTemplate is used to inject controls into a TextBox, the wrong control is returned from calls to `UIAutomation.ElementFromPoint`.

**Actual behavior:**
The element returned from `UIAutomation.ElementFromPoint` is the element whose ControlTemplate has been overridden.

**Expected behavior:**
The element returned from `UIAutomation.ElementFromPoint` should be the element that corresponds to the provided point, even if it was injected via the ControlTemplate

**Minimal repro:**
1. Create a new WPF app
2. Replace the boilerplate grid with the following:
```


<Setter Property="Template">
<Setter.Value>
<ControlTemplate TargetType="{x:Type TextBoxBase}">
<DockPanel LastChildFill="True">
<TextBlock
Margin="2,2,8,2"
VerticalAlignment="Center"
Text="This fails" />
<Border
BorderBrush="Gray"
BorderThickness="1"
CornerRadius="2" />
</DockPanel>
</ControlTemplate>
</Setter.Value>
</Setter>











```
3. Run the app without hot reload (it interferes with UIA)
4. Run [Accessibility Insights for Windows](https://github.com/microsoft/accessibility-insights-windows/releases/latest)
5. Set AIWin to use Raw mode (happens without this, but shows that UIA knows about all the controls)
6. Hover over the TextBlock labeled "This works"--note that you're inspecting the Text control
7. Hover over the TextBlock labeled "This fails"--note that you're inspecting the Edit control, even though the cursor is over the injected TextBlock. We've debugged through the code, and [this call](https://github.com/DaveTryon/axe-windows/blob/10ebde941552843208125adddd1418ed55b2de6b/src/Desktop/UIAutomation/A11yAutomation.cs#L315) to `UIAutomation.ElementFromPoint` is always returning the Edit control, even when the cursor is over the injected TextBlock.