[Reland] Web Animations: Introduce String based KeyframeEffectModel

Note: This is a rework of issue 212023004

This patch refactors KeyframeEffectModel to support different types of
keyframe values. The common keyframe logic is retained in
KeyframeEffectModelBase to be inherited by the keyframe type specialisations.

KeyframeEffectModel is then templated on Keyframe type, with a hierarchy of Keyframes
including StringKeyframe and AnimatableValueKeyframe being introduced.

String based keyframes are being introduced to properly support the JS API
for Web Animations element.animate().

Original issue: https://codereview.chromium.org/215883005

Please note that this version includes the Oilpan changes made in
https://codereview.chromium.org/222893005/

TBR=dstockwell

Review URL: https://codereview.chromium.org/223443002

git-svn-id: svn://svn.chromium.org/blink/trunk@170768 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Replace most of RefPtrs of Event objects with oilpan's transition types

- Basically, this CL does the following three things:

(1) Replace PassRefPtr<xxxEvent> with PassRefPtrWillBeRawPtr<xxxEvent>.

(2) Replace RefPtr<xxxEvent> in on-heap objects with RefPtrWillBeMember<xxxEvent>.

(3) Replace RefPtr<xxxEvent> in off-heap objects with RefPtrWillBePersistent<xxxEvent>.

- This CL is not replacing any raw pointers with Members/Persistents, so it won't produce new memory leaks.

- This CL uses ListHashSet<Persistent<Event>> for DOMWindowEventQueue::m_queuedEvents, because HeapListHashSet is not yet implemented.

- This CL uses Deque<Persistent<Event>> for WebSocket::m_events, because HeapDeque is not yet implemented.

- In follow-up CLs, I will move more Event related objects to the heap and reduce Persistent handles introduced in this CL.

BUG=340522

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=170733

Review URL: https://codereview.chromium.org/216523002

git-svn-id: svn://svn.chromium.org/blink/trunk@170769 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Do not leak linkified locations when heap snapshot is deleted

BUG=None

Review URL: https://codereview.chromium.org/223303003

git-svn-id: svn://svn.chromium.org/blink/trunk@170770 bbb929c8-8fbe-4397-9dbb-9b2b20218538