object: Trace vfunc trampolines

Previously these trampolines were leaked, and the JS functions they
pointed to were treated as weak pointers. We still have to leak the
trampoline structs themselves, because the GType's vtable still refers to
them.

However, we can tie the JS functions to the lifetime of the prototype
and trace them during garbage collection, which will become required in
SpiderMonkey 38 when they can be moved around during GC.

https://bugzilla.gnome.org/show_bug.cgi?id=776966