Customize RefCell instead of wrapping it

This gets rid of a dubious transmute:

    let val = mem::transmute::<&RefCell<T>, &T>(&self.base);

The code duplication will be reduced once rust-lang/rust#18131 is fixed.
Fix a layout method to use borrow_for_layout()
Dynamically check DOMRefCell access from layout in debug builds
Ignore the HTML parser's borrow flag in GC tracing

Adds some other dynamic checks in debug builds.
task_state: Generate the list of task types

Also fix warnings.
Provide safety check helpers in release builds

debug_assert! uses

    if cfg!(not(ndebug)) { ... }

so the body in a release build is dead code, but it still needs to compile.
auto merge of #3797 : kmcallister/servo/domrefcell, r=jdm

r? @mbrubeck, @jdm

Alternative to #3770 and #3716.