LibWeb: Use SafeFunction for completion steps in "populate SHE"

...to visit GC-allocated objects captured by this callback.

Userland/Libraries/LibWeb/HTML/Navigable.cpp

@@ -1025,7 +1025,7 @@ WebIDL::ExceptionOr<void> Navigable::populate_session_history_entry_document(
     Variant<Empty, JS::NonnullGCPtr<NavigationParams>, JS::NonnullGCPtr<NonFetchSchemeNavigationParams>> navigation_params,
     CSPNavigationType csp_navigation_type,
     bool allow_POST,
-    Function<void()> completion_steps)
+    JS::SafeFunction<void()> completion_steps)
 {
     // FIXME: 1. Assert: this is running in parallel.
 

Userland/Libraries/LibWeb/HTML/Navigable.h

@@ -123,7 +123,7 @@ public:
         Variant<Empty, JS::NonnullGCPtr<NavigationParams>, JS::NonnullGCPtr<NonFetchSchemeNavigationParams>> navigation_params = Empty {},
         CSPNavigationType csp_navigation_type = CSPNavigationType::Other,
         bool allow_POST = false,
-        Function<void()> completion_steps = [] {});
+        JS::SafeFunction<void()> completion_steps = [] {});
 
     struct NavigateParams {
         URL::URL const& url;