Before the completion_steps for timer were casted from JS::SafeFunction
to Function in HTML::Timer constructor, which is incorrect because then
callback's captured GC-allocated objects are not protected from being
deallocated. Let's modify HTML::Timer to use JS::HeapFunction for the
callback instead.
This change implements a step from the document's destroy procedure in
the specification, saying that all active timers should be cleared.
By doing this, we also fix the leaking of a document in case where we
have navigated away from a page that has scheduled timers that haven't
yet been triggered.
This is where it belongs according to the spec, and where these methods'
IDL will be placed.
This forces us to implement a few steps closer to the spec as well.
This will allow us to easily share the implementations of these methods
between Window and WorkerGlobalScope. The mixin class mirrors what I
already did for the Fetch API's Body mixin in 5ad62833.
