js: Refactor dual use of JS::Heap wrapper

The previous situation was that a JS::Heap wrapper was used to root a GC
thing under some conditions using JS::AddFooRoot() or the keep-alive
object, and trace or maintain a weak pointer otherwise.

This will not be possible anymore in SpiderMonkey 38. JS::AddFooRoot()
and JS::RemoveFooRoot() are going away, in favour of
JS::PersistentRootedFoo. The keep-alive object has its own problems,
because the SpiderMonkey 38 garbage collector will move GC things around,
so anything referring to a GC thing on the keep-alive object will have to
know when to update its JS::Heap wrapper when the GC thing moves.

This previous situation existed in two places.

  (1) The JS::Value holding a trampoline's function. If the function was
  owned by the trampoline (the normal case), then it was rooted. If the
  function was a vfunc, in which case it was owned by the GObject class
  prototype and the trampoline was essentially leaked, then it remained a
  weak pointer.

  (2) The JSObj...