HTML Reporter: Enable activating config.hidepassed from URL params

Loading a QUnit test suite with `?hidepassed` appended to the URL is
useful for CI services that take a screenshot of the completed test
suite upon completion in various browsers, for example.
HTML Reporter: same handler for both "click" & "change" toolbar events

Since the handlers were mostly identical, it makes sense to consolidate
them and to simply detect when we're dealing with a SELECT menu by
detecting the `selectedIndex` property.

This makes it easier to make future changes to event handling since
it's all in a single place now.
HTML Reporter: update URL without refreshing for config.hidepassed

config.hidepassed will typically be toggled after the tests are under
way or finished running. Since it's only supposed to toggle one HTML
classname, it doesn't make sense to refresh the whole page like toggling
other toolbar options does. Instead, use `history.replaceState()` if
available to update the browser URL without refreshing.