Bug 1467437. Align with other browsers and the spec for whether hashchange and popstate events bubble. r=smaug

I think I caught all the places in our tree that add event listeners for these
events on a non-Window (and hence depend on bubbling behavior), but I'm a
little worried about what happens if webextensions do bareword
addEventListener() for these events...

Differential Revision: https://phabricator.services.mozilla.com/D66798