LibWeb+LibJS: Make the EventTarget hierarchy (incl. DOM) GC-allocated

This is a monster patch that turns all EventTargets into GC-allocated
PlatformObjects. Their C++ wrapper classes are removed, and the LibJS
garbage collector is now responsible for their lifetimes.

There's a fair amount of hacks and band-aids in this patch, and we'll
have a lot of cleanup to do after this.

Userland/Libraries/LibWeb/HTML/Parser/ListOfActiveFormattingElements.h

@@ -20,7 +20,7 @@ public:
     struct Entry {
         bool is_marker() const { return !element; }
 
-        RefPtr<DOM::Element> element;
+        JS::Handle<DOM::Element> element;
     };
 
     bool is_empty() const { return m_entries.is_empty(); }