Rewrite event handlers section for more rigor and correctness

* Move the "When an event handler H of an EventTarget object T is first
  set to a non-null value" steps into a dedicated "activate an event
  handler" algorithm. Create a corresponding "deactivate an event
  handler" algorithm, called in the circumstances outlined in whatwg#3836,
  thereby fixing whatwg#3836.

* Define "When an event handler content attribute is set" and "When an
  event handler content attribute is removed" steps rigorously using
  the attribute change steps hook in DOM. Care is taken to clarify
  certain edge cases, such as calling removeAttribute() on a nonexistent
  event handler content attribute but with a corresponding event handler
  IDL attribute defined, and calling setAttribute() an attribute with
  the same value as it currently possesses but with the event handler
  deactivated (exhibit B in whatwg#3836).

* Formalize multiple definitions:
  * event handler as a struct containing a value and an event listener
  * location of event handlers and the concept of event handler target
  * rigorous set of steps on how to obtain the target of an event
    handler through the "determine the target of an event handler"
    algorithm. The latter algorithm supersedes the handwavy and
    inconsistently-applied "If an event handler IDL attribute exposes an
    event handler of an object that doesn't exist" steps.
  * storage of event handlers in the event handler map

* More descriptive variable names: H → eventHandler, T → eventTarget,
  and E → event, in various algorithms.

Tests: web-platform-tests/wpt#12201

Follow-up issue to improve clarity by breaking this up into smaller
sections: whatwg#3861.