Fix another setTimeout-derived security bug.

The guest-provided value of (virtual) window.onload was passed to
setTimeout without verification, allowing a string to be passed in and
thus evaluated in the host page context.

All occurrences of setTimeout with guest-provided callbacks in Domado
have now been funneled through the tamed setTimeout. Only window.onload
was specifically vulnerable, but I have changed the others to gain the
other robustness benefits outlined in tameSetAndClear.

[metaweta, 2012-12-21 01:35:59]

Is there anything we can do to prevent future uses of window.setTimeout?

[metaweta, 2012-12-21 01:40:05]

lgtm