Use RefPtr for MutationObserver in MutationObserverInterestGroup.
In MutaionObserverInterestGroup, MutationObservers were held in HashSet
as raw pointers. In case a MutationObserver is gone while mutation
events are collected (and garbage collector collects the object),
it causes use-after-free while the code tries to enqueue the recorded
mutation events. Use RefPtr<> to hold the pointer so that the object
will be kept until it goes out of scope.