Auto merge of #26480 - CYBAI:missing-on, r=jdm

Prefix `on` for function name of inline events

While checking what needs to be done for the spec-update, I've noticed the logic of checking `is window-reflecting element (e.g. body and frameset)` is already handled by the `is` casting function.

However, we still failed to pass the tests because we're missing `on` prefix for inline functions.

I'm not sure if this patch is good enough (or maybe at least I need to add a comment for why adding `on` prefix?).

Besides, I checked [how Gecko handles](https://searchfox.org/mozilla-central/rev/8bc4e35c9bb47c1fe3131e6155d9f482e1efef9a/dom/events/EventListenerManager.cpp#1012-1022) and looks like they also just pass the atom directly.
But, the [generated atom](https://searchfox.org/mozilla-central/source/__GENERATED__/xpcom/ds/nsGkAtomList.h#775) is prefixed with `on` which is correct to just pass it into the `CompileFunction`.

---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `___` with appropriate data: -->
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #26479
- [x] There are tests for these changes

<!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.-->

<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->

components/script/dom/eventtarget.rs

@@ -512,7 +512,7 @@ impl EventTarget {
         // Step 3.9
 
         let url_serialized = CString::new(handler.url.to_string()).unwrap();
-        let name = CString::new(&**ty).unwrap();
+        let name = CString::new(format!("on{}", &**ty)).unwrap();
 
         // Step 3.9, subsection ParameterList
         static mut ARG_NAMES: [*const c_char; 1] = [b"event\0" as *const u8 as *const c_char];