Fully asynchronous menu command implementation.

1) Store menu commmands' data in a private closure, *in the sandbox*.
2) To list registered commands:
  a) Parent/chrome passes a message to child/frame.
  b) Frame passes an event (visible to content) into the sandbox.
  c) Sandbox passes private-closure-scoped commands' data to a frame-scoped callback.
  d) Frame passes data up to parent as a message.
  e) Chrome uses this data to populate the menu, at popupshowing time.
3) To run a command:
  a) User clicks on the menu item.
  b) Chrome sends a message to the frame.
  c) Frame sends an event to the sandbox.
  d) Sandbox finds the related registered command, calls its callback.

Phew!  But no references to documents/windows/browsers are ever stored anywhere, so they can't possibly leak anymore.

Along the way, simplify frame script by moving object methods to standalone functions; less state, less binding to fix "this" references.  The ContentObserver object is now really just there for `.observe()`.

TODO: Restore "delayed execution" feature, the only other usage of the (removed) ScriptRunner structure.

Refs: greasemonkey#2200
Refs: greasemonkey#2067

content/browser.js

@@ -357,22 +357,17 @@ function GM_showPopup(aEvent) {
       function(script) { point = appendScriptAfter(script, point); });
 
   // Propagate to commands sub-menu.
-  var commandsPopup = popup.querySelector(
-      'menupopup.greasemonkey-user-script-commands-popup');
-  GM_MenuCommander.onPopupShowing(commandsPopup);
+  GM_MenuCommander.onPopupShowing(aEvent);
 }
 
 /**
  * Clean up the menu after it hides to prevent memory leaks
  */
 function GM_hidePopup(aEvent) {
-  var popup = aEvent.target;
   // Only handle the actual monkey menu event.
   if (aEvent.currentTarget != aEvent.target) return;
   // Propagate to commands sub-menu.
-  var commandsPopup = popup.querySelector(
-      'menupopup.greasemonkey-user-script-commands-popup');
-  GM_MenuCommander.onPopupHiding(commandsPopup);
+  GM_MenuCommander.onPopupHiding();
 }
 
 // Short-term workaround for #1406: Tab Mix Plus breaks opening links in