Abstract child node lookup into `childAt`

Currently, opcodes that look up child nodes are hard-coded to generate
a chain of `childNodes[idx]` lookups.

This change abstracts that lookup by adding a `childAt` method to the
DOM helper, which takes an element and an array of indices to look up.

For example, the old code:

```js
fragment.childNodes[0].childNodes[1].childNodes[0];
```

is replaced by:

```js
dom.childAt(fragment, [0, 1, 0]);
```

This change allows us to abstract child node lookup so that the elements
returned from e.g. `dom.cloneNode` or `dom.createDocumentFragment` do
not have to implement a subset of the DOM API, and helps keep all of the
abstraction in the single DOM helper object.