Fix InvalidCastException in Control.OnHandleDestroyed for non-ControlAccessibleObject (#14295)

<!-- Please read CONTRIBUTING.md before submitting a pull request -->

Fixes #14291

## Root Cause

`Control.OnHandleDestroyed` used
`Properties.TryGetValue<ControlAccessibleObject>` for both
AccessibilityObject and NcAccessibilityObject, assuming the stored
instance was always a ControlAccessibleObject. When a control overrides
`CreateAccessibleObject()` to return a different AccessibleObject type,
the generic `TryGetValue<T>` attempted an invalid cast and threw
`InvalidCastException` during handle destruction.

## Proposed changes

- Change the lookups in `Control.OnHandleDestroyed` for
`s_accessibilityProperty` and `s_ncAccessibilityProperty` from
`TryGetValue<ControlAccessibleObject>` to
`TryGetValue<AccessibleObject>`, then use type pattern matching (`accObj
is ControlAccessibleObject controlAccObj`) before resetting
`controlAccObj.Handle = IntPtr.Zero`, so only true
`ControlAccessibleObject` instances are manipulated and other
AccessibleObject types no longer cause invalid casts.

<!-- We are in TELL-MODE the following section must be completed -->

## Customer Impact

- This change prevents `InvalidCastException` crashes when controls with
custom accessible objects are destroyed

## Regression? 

- Yes (Regress by commit
d08128b#diff-07a0a87cedab0d76c974ce8b105912a1b986c87116c7ee0ac73d6d5d65e4b48aL7643)

## Risk

- Minimal

<!-- end TELL-MODE -->


## Screenshots <!-- Remove this section if PR does not change UI -->

### Before
Sample project: 

[WinFormsApp15.zip](https://github.com/user-attachments/files/25253150/WinFormsApp15.zip)

On teardown, If a custom overrode CreateAccessibleObject() and returned
a different AccessibleObject type, TryGetValue<ControlAccessibleObject>
threw an InvalidCastException when the handle was destroyed, potentially
crashing the app.


https://github.com/user-attachments/assets/c37feba7-58f8-47db-a20e-fcc540ebc11d


### After
Custom accessible objects that are not `ControlAccessibleObject` are
left untouched during handle destruction, so no `InvalidCastException`
is thrown and the app stays stable.


https://github.com/user-attachments/assets/9d89b29c-c1b4-4b37-924e-4eaf23bec610


## Test methodology <!-- How did you ensure quality? -->

- Manually
 

## Test environment(s) <!-- Remove any that don't apply -->

- .net 11.0.0-preview.2.26080.101


<!-- Mention language, UI scaling, or anything else that might be
relevant -->

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/dotnet/winforms/pull/14295)

Author: LeafShi1

src/System.Windows.Forms/System/Windows/Forms/Control.cs

@@ -7518,14 +7518,16 @@ protected virtual void OnHandleDestroyed(EventArgs e)
         ((EventHandler?)Events[s_handleDestroyedEvent])?.Invoke(this, e);
 
         // The Accessibility Object for this Control
-        if (Properties.TryGetValue(s_accessibilityProperty, out ControlAccessibleObject? accObj))
+        if (Properties.TryGetValue(s_accessibilityProperty, out AccessibleObject? accObj)
+            && accObj is ControlAccessibleObject controlAccObj)
         {
-            accObj.Handle = IntPtr.Zero;
+            controlAccObj.Handle = IntPtr.Zero;
         }
 
         // Private accessibility object for control, used to wrap the object that
         // OLEACC.DLL creates to represent the control's non-client (NC) region.
-        if (Properties.TryGetValue(s_ncAccessibilityProperty, out ControlAccessibleObject? nonClientAccessibleObject))
+        if (Properties.TryGetValue(s_ncAccessibilityProperty, out AccessibleObject? ncAccObj)
+            && ncAccObj is ControlAccessibleObject nonClientAccessibleObject)
         {
             nonClientAccessibleObject.Handle = IntPtr.Zero;
         }

src/test/unit/System.Windows.Forms/System/Windows/Forms/ControlTests.Methods.cs

@@ -412,6 +412,19 @@ public void Control_CreateAccessibilityInstance_Invoke_ReturnsExpected(bool crea
         Assert.Equal(createHandle, control.IsHandleCreated);
     }
 
+    [WinFormsFact]
+    public void Control_OnHandleDestroyed_CustomAccessibleObject_DoesNotThrow1()
+    {
+        using CustomCreateAccessibilityInstanceControl control = new()
+        {
+            CreateAccessibilityResult = new AccessibleObject()
+        };
+
+        AccessibleObject accessibleObject = control.AccessibilityObject;
+        Action action = () => control.InvokeOnHandleDestroyed(EventArgs.Empty);
+        action.Should().NotThrow();
+    }
+
     [WinFormsFact]
     public void Control_CreateControl_Invoke_Success()
     {

src/test/unit/System.Windows.Forms/System/Windows/Forms/ControlTests.Properties.cs

@@ -100,6 +100,8 @@ private class CustomCreateAccessibilityInstanceControl : Control
         public AccessibleObject CreateAccessibilityResult { get; set; }
 
         protected override AccessibleObject CreateAccessibilityInstance() => CreateAccessibilityResult;
+
+        public void InvokeOnHandleDestroyed(EventArgs eventArgs) => OnHandleDestroyed(eventArgs);
     }
 
     [WinFormsTheory]