Fix up our <command> elements

Following bugzilla bug 1890547 we should replace our last few onclick and oncommand attributes with addEventListener calls.

I can't see any other on* attributes, but I'll double check.

Update: this was already done in the ESR 140 rebase, but we need to fix and tidy our <command> usage.