[WebGPU] Release assert trigged in PipelineLayout::offsetVectorForBin…

…dGroup

https://bugs.webkit.org/show_bug.cgi?id=274317
<radar://128065029>

Reviewed by Dan Glastonbury.

Invalid bind group should return nullptr as it already does in other
places in this member function instead of crashing the GPU process.

* LayoutTests/TestExpectations:
* LayoutTests/fast/webgpu/fuzz-274317-expected.txt: Added.
* LayoutTests/fast/webgpu/fuzz-274317.html: Added.
Add regression test.

* Source/WebGPU/WebGPU/PipelineLayout.mm:
(WebGPU::PipelineLayout::offsetVectorForBindGroup):

Canonical link: https://commits.webkit.org/279013@main

LayoutTests/TestExpectations

@@ -2125,6 +2125,8 @@ webkit.org/b/139639 [ Debug ] cssom/non-subpixel-scroll-top-left-values.html [ S
 [ Release ] fast/webgpu/fuzz-274271.html [ Pass Failure Timeout ]
 [ Debug ] fast/webgpu/fuzz-274275.html [ Skip ]
 [ Release ] fast/webgpu/fuzz-274275.html [ Pass Failure Timeout ]
+[ Debug ] fast/webgpu/fuzz-274317.html [ Skip ]
+[ Release ] fast/webgpu/fuzz-274317.html [ Pass Failure Timeout ]
 
 # Imported W3C HTML/DOM ref tests that are failing.
 imported/w3c/web-platform-tests/html/dom/elements/global-attributes/dir_auto-textarea-script-N-between-Rs.html [ ImageOnlyFailure ]