Bumping gaia.json for 2 gaia revision(s) a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/518c147231ee
Author: Min-Zhong "John" Lu <jlu@mozilla.com>
Desc: Merge pull request #24467 from mnjul/bug_1044525_kb_keep_dom_element_at_renderjs_with_unittest

Bug 1044525 - Avoid poking with DOM elements in various modules aside from renderer by using a WeakMap to hold layout key objects, mapped from DOM elements. r=timdream. f=rudyl

========

https://hg.mozilla.org/integration/gaia-central/rev/a0da2261a00b
Author: John Lu [:mnjul] <jlu@mozilla.com>
Desc: Bug 1044525 - Avoid poking with DOM elements in various modules aside from renderer by using a WeakMap to hold layout key objects, mapped from DOM elements.

- render.js's key properties normalization is now done in LayoutNormalizer. The normalization for static layouts takes place in layout loader, when the layout is loaded. Layout Manager's on-the-fly generated keys are pre-normalized in the hard-coded structures.
- Also, removed parseInt() on keycodes where suitable as we now retreive "number" from the objects held by WeakMap.

We have two WeakMaps, one maps DOM element to abstract target objects ("forward" map), and one maps inversely ("reverse" map)
Policy of accessing those WeakMaps is:
- IMERender and AltCharMenu(View) can set both forward and reverse maps by calling IMERender.setDomElemTargetObject, a small helper function.
- Everyone can retrieve forward mapping (elem to obj) in layoutRenderingManager with LRM.getTargetObject.
- Only IMERender and AltCharMenu(View) can retrieve reverse mapping (obj to elem) accessible through IMERender's reverse map (targetObjDomMap).
 -- currently we need to allow AltCharMenuManager to do so 'coz their responsibility and coupling aren't very clear.
 -- we probably need some refactoring work to reassign the responsibility and coupling such that targetObjDomMap isn't unnecessarily exposed.
Bumping manifests a=b2g-bump