LibWeb+LibJS: Make the EventTarget hierarchy (incl. DOM) GC-allocated

This is a monster patch that turns all EventTargets into GC-allocated
PlatformObjects. Their C++ wrapper classes are removed, and the LibJS
garbage collector is now responsible for their lifetimes.

There's a fair amount of hacks and band-aids in this patch, and we'll
have a lot of cleanup to do after this.

Userland/Libraries/LibWeb/NavigationTiming/PerformanceTiming.h

@@ -14,7 +14,7 @@
 namespace Web::NavigationTiming {
 
 class PerformanceTiming final
-    : public RefCountForwarder<HTML::Window>
+    : public RefCounted<PerformanceTiming>
     , public Bindings::Wrappable {
 public:
     using WrapperType = Bindings::PerformanceTimingWrapper;
@@ -44,6 +44,9 @@ public:
     u64 dom_complete() { return 0; }
     u64 load_event_start() { return 0; }
     u64 load_event_end() { return 0; }
+
+private:
+    JS::Handle<HTML::Window> m_window;
 };
 
 }