Return a JS<T> from *Binding::Wrap rather than a JSObject.

This lets us avoid the sketchy tricks in JS::new and Window::new, where we
kept an unsafe pointer to the native object across the Wrap call that
consumed the owned pointer.