Use html5ever for HTML parsing

r? @Ms2ger, @jdm

The parser is now a JS-managed object and we use hooks in html5ever to trace its internal state.  This should be memory-safe even if arbitrary JavaScript can run during a parse.  Please let me know if you think of a reason it wouldn't be!

I think the likely outcome of a garbage collection during parsing is a dynamic `RefCell` borrow failure, but I'm going to look into that after this lands.  It should be safe to trace the parser while it's mutably borrowed, as long as it's not shared between threads, so we can probably switch to `UnsafeCell`.