LibWeb: Move event listeners, handlers and callbacks to the GC heap

This patch moves the following things to being GC-allocated:
- Bindings::CallbackType
- HTML::EventHandler
- DOM::IDLEventListener
- DOM::DOMEventListener
- DOM::NodeFilter

Note that we only use PlatformObject for things that might be exposed
to web content. Anything that is only used internally inherits directly
from JS::Cell instead, making them a bit more lightweight.

Userland/Libraries/LibWeb/Bindings/WindowObject.h

@@ -24,7 +24,7 @@ namespace Web {
 namespace Bindings {
 
 // https://html.spec.whatwg.org/#timerhandler
-using TimerHandler = Variant<CallbackType, String>;
+using TimerHandler = Variant<JS::Handle<CallbackType>, String>;
 
 class WindowObject
     : public JS::GlobalObject