Dynamically check DOMRefCell access from layout in debug builds
Ignore the HTML parser's borrow flag in GC tracing

Adds some other dynamic checks in debug builds.