Fix uses of JS<T> as a type on the stack
`JS<T>` belongs on the heap, and only on the heap. This is a collection of fixes so that code uses either `Root<T>` or `&T` to pass around garbage-collected pointers.
Ideally, we could completely ban constructing a `JS<T>` outside of constructor functions, but we aren't quite there yet.
<!-- Reviewable:start -->
[<img src="https://reviewable.io/review_button.png" height=40 alt="Review on Reviewable"/>](https://reviewable.io/reviews/servo/servo/8026)
<!-- Reviewable:end -->
7c7dbde0f4
