script: Stop trusting pointers to DOM nodes coming from layout.

Because box building is complex, it's a hard sell that it should be part
of the TCB. Therefore, we don't trust any pointers to DOM nodes coming
back from script. This is done with a pointer hash table similar to the
one that Boehm GC uses. Accesses in it are very quick, but it may be
more efficient in the future to simply have a way to ask the JS engine
whether a particular piece of memory is a valid DOM node.

r? @jdm