HTML Reporter: Enable activating config.hidepassed from URL params

Loading a QUnit test suite with `?hidepassed` appended to the URL is
useful for CI services that take a screenshot of the completed test
suite upon completion in various browsers, for example.

Since the event handlers for click and change were mostly identical, it
makes sense to consolidate them and to simply detect when we're dealing
with a SELECT menu by detecting the `selectedIndex` property.

config.hidepassed will typically be toggled after the tests are under
way or finished running. Since it's only supposed to toggle one HTML
classname, it doesn't make sense to refresh the whole page like toggling
other toolbar options does. Instead, use `history.replaceState()` if
available to update the browser URL without refreshing.

Fixes #457
Closes #678