LibCore: Make CObject reference-counted

Okay, I've spent a whole day on this now, and it finally kinda works!
With this patch, CObject and all of its derived classes are reference
counted instead of tree-owned.

The previous, Qt-like model was nice and familiar, but ultimately also
outdated and difficult to reason about.

CObject-derived types should now be stored in RefPtr/NonnullRefPtr and
each class can be constructed using the forwarding construct() helper:

    auto widget = GWidget::construct(parent_widget);

Note that construct() simply forwards all arguments to an existing
constructor. It is inserted into each class by the C_OBJECT macro,
see CObject.h to understand how that works.

CObject::delete_later() disappears in this patch, as there is no longer
a single logical owner of a CObject.

Libraries/LibCore/CEventLoop.cpp

@@ -43,7 +43,7 @@ public:
             int nread = m_socket->read((u8*)&length, sizeof(length));
             if (nread == 0) {
                 dbg() << "RPC client disconnected";
-                delete_later();
+                shutdown();
                 return;
             }
             ASSERT(nread == sizeof(length));
@@ -52,7 +52,7 @@ public:
             auto request_json = JsonValue::from_string(request);
             if (!request_json.is_object()) {
                 dbg() << "RPC client sent invalid request";
-                delete_later();
+                shutdown();
                 return;
             }
 
@@ -111,11 +111,17 @@ public:
         }
 
         if (type == "Disconnect") {
-            delete_later();
+            shutdown();
             return;
         }
     }
 
+    void shutdown()
+    {
+        // FIXME: This is quite a hackish way to clean ourselves up.
+        delete this;
+    }
+
 private:
     ObjectPtr<CLocalSocket> m_socket;
 };
@@ -148,7 +154,8 @@ CEventLoop::CEventLoop()
         s_rpc_server->on_ready_to_accept = [&] {
             auto client_socket = s_rpc_server->accept();
             ASSERT(client_socket);
-            new RPCClient(move(client_socket));
+            // NOTE: RPCClient will delete itself in RPCClient::shutdown().
+            (void)RPCClient::construct(move(client_socket)).leak_ref();
         };
     }
 
@@ -246,6 +253,7 @@ void CEventLoop::pump(WaitMode mode)
 #endif
             static_cast<CDeferredInvocationEvent&>(event).m_invokee(*receiver);
         } else {
+            NonnullRefPtr<CObject> protector(*receiver);
             receiver->dispatch_event(event);
         }