Rendering: update when an image creates a replaced box

This aligns the standard with Chromium/WebKit and an upcoming release of Firefox.

In particular, the two cases that need to work are:

* <img> (without alt) creates a replaced box, regardless of specified dimensions or what not.

* <img src="foo" alt="bar"> creates a replaced box while the image is loading, rather than an inline.

Tests are in https://phabricator.services.mozilla.com/D11194.

source

@@ -113521,20 +113521,18 @@ iframe { border: 2px inset; }
 
    <dt>
 
-    If the element does not <span data-x="represents">represent</span> an image, but the element
-    already has <span>intrinsic dimensions</span> (e.g. from the <span>dimension attributes</span>
-    or CSS rules), and either:
+    If the element does not <span data-x="represents">represent</span> an image and either:
 
     <ul>
-
      <li>the user agent has reason to believe that the image will become <i
      data-x="img-available">available</i><!--input-img-available also--> and be rendered in due
      course, or
 
      <li>the element has no <code data-x="">alt</code> attribute<!-- attr-img-alt, attr-input-alt -->, or
 
-     <li>the <code>Document</code> is in <span>quirks mode</span>
-
+     <li>the <code>Document</code> is in <span>quirks mode</span>, and the element already has
+     <span>intrinsic dimensions</span> (e.g., from the <span>dimension attributes</span> or CSS
+     rules)
     </ul>
 
    </dt>