40041: Writing bridge settings is broken in esr78-based Tor Browser

Fixes #40041 (closed).

When translating inline oncommand to JS event listeners I overlooked something: this in the former case is not equivalent to e.target in the latter, since this always points to the element, while e.target may point to a children element. So, I removed all usages of e.target and replaced by a direct reference to the element.

This was an issue because the radiogroup receives command events for itself and for the menulist child element. Maybe we should also explicitly filter events based on target, but as long as we get the value right it should not be harmful for the radiogroup to receive two command events (and that should actually be the behaviour of the patch in ESR68).