LibWeb: Move event listeners, handlers and callbacks to the GC heap

This patch moves the following things to being GC-allocated:
- Bindings::CallbackType
- HTML::EventHandler
- DOM::IDLEventListener
- DOM::DOMEventListener
- DOM::NodeFilter

Note that we only use PlatformObject for things that might be exposed
to web content. Anything that is only used internally inherits directly
from JS::Cell instead, making them a bit more lightweight.

Userland/Libraries/LibWeb/XHR/XMLHttpRequest.h

@@ -72,7 +72,7 @@ public:
     String get_all_response_headers() const;
 
     Bindings::CallbackType* onreadystatechange();
-    void set_onreadystatechange(Optional<Bindings::CallbackType>);
+    void set_onreadystatechange(Bindings::CallbackType*);
 
     DOM::ExceptionOr<void> override_mime_type(String const& mime);