Privatize DOM (fixes #3644)

This PR removes public fields from all (hope I didn't miss any) DOM structs. Should |Page| be privatized as well? This PR additionally introduces a #[privatize] lint to ensure nobody accidentally re-introduces a public field.

All changesets compile separately if applied in the same order. Hope that helps reviewing but I can of course squash them before merging.