fix intermittent Option::unwrap in timers
fixes intermittent #8616
This intermittent indicates real problem in code.
Lets consider such code:
```javascript
// timer 1
setTimeout(function() {
//timer 2
setTimeout(function() {}, 0);
}, 0);
```
When we receive event to fire timer 1 it will be selected and extracted from active timers list in fire_timer function. During timer 1 handler execution we will schedule timer 2 and request timer event for it. But it will be executed during same fire_timer call because of 0 timeout. And as a result we will have empty timers list and expecting event for timer 2 that will crash in assert.
I'm not sure that all I've written is clear, but we have something like this:
```
install timer 1 -> [1] in timers list
push and expect timer event 1 -> expected_event=1
received timer event 1
fire_timer()
select timer 1 to execute -> [] in timers list
execute timer 1 handler
install timer 2 -> [2] in timers list
push and expect timer event 2 -> expected_event=2
select timer 2 to execute (because of 0 timeout) -> [] in tiemrs list
execute timer 2 handler
expected_event=2 is dangling
received timer event 2
fire_timer() -> BOOM
```
<!-- Reviewable:start -->
[<img src="https://reviewable.io/review_button.png" height=40 alt="Review on Reviewable"/>](https://reviewable.io/reviews/servo/servo/8768)
<!-- Reviewable:end -->
This is mostly stolen from Gecko. As there, we define the unforgeable members
on an object stored in the slots of the prototype object. They are then copied
onto instance objects when they are instantiated. It should be noted that
proxy objects see their unforgeable memebers defined on their expando object.
Unforgeable attributes aren't properly inherited in codegen (in a similar
fashion as getters and setters as filed in #5875) and require to be redefined
in derived interfaces. Fortunately, there are currently no such interfaces.
No unforgeable members can be included into the TestBinding interfaces for good
measure because they are not compatible with setters.
Given the unforgeable holder object has the same prototype as actual instances
of the interface, the finalize hook needs to check its slot pointer for nullity
before dropping it.
The new failing test isn't related to Unforgeable attributes, but to the fact
that all Document instances currently have a Location, even if their window
isn't in a browsing context.
Implement Range#deleteContents
Sadly calling ExtractContents and discarding the result doesn't do the right thing.
It may be worth having a CutContents method that takes an `Option<DocumentFragment>` and switch the behavior based on it, to share the code between DeleteContents and ExtractContents, like what Gecko does. Maybe a followup.
<!-- Reviewable:start -->
[<img src="https://reviewable.io/review_button.png" height=40 alt="Review on Reviewable"/>](https://reviewable.io/reviews/servo/servo/6826)
<!-- Reviewable:end -->
