LibJS+LibWeb: Make HTML::Script GC-allocated

This allows the garbage collector to keep HTML::Script objects alive and
fixes a bug where a HTMLScriptElement could get GC'd while its code was
executing.

Userland/Libraries/LibJS/Script.h

@@ -22,6 +22,8 @@ class Script final : public Cell {
 public:
     struct HostDefined {
         virtual ~HostDefined() = default;
+
+        virtual void visit_host_defined_self(Cell::Visitor&) = 0;
     };
 
     virtual ~Script() override;