[Oilpan]: Make StylePropertySet fully garbage collected.

This also required moving ElementData and subclasses to the oilpan heap to
avoid a RefPtr -> Persistent -> Member cycle.

This change makes use of the ephemeron (weak hashmap with fix point)
support to remove elements in the MatchedPropertiesCache during a GC.
This is done by specializing the HashTrait for the value in the hash
map since it is the one with the embedded WeakMember. The specialized
HashTrait's traceInCollection method is called iteratively during GC
tracing to mark the entries that are live in the map. It is also called
during GC weak processing where it must report back whether a specific
element is alive or dead. If dead it is removed from the map.

One caveat is if the map is being traced strongly in which case the
weak members are traced as normal members. This can happen if there
is an iterator to the map on the stack.

I have also changed back to the add/assign pattern for putting entries
into hash maps to avoid the extra lookup I added. This should be safe
since we will have a pointer to the hash map's backing on the stack if
a GC occur so the backing and its entries should be marked strongly,
meaning it should be moved.
  
R=ager@chromium.org, erik.corry@gmail.com, haraken@chromium.org, oilpan-reviews@chromium.org, tkent@chromium.org, vegorov@chromium.org, zerny@chromium.org
BUG=341815

Review URL: https://codereview.chromium.org/273843003

git-svn-id: svn://svn.chromium.org/blink/trunk@177012 bbb929c8-8fbe-4397-9dbb-9b2b20218538