fix(Network): pass nullish XHR event callbacks through instead of wrapping them

[cyhano]

Fixes #740

Problem

Libraries like hls.js clear XHR event callbacks before aborting in-flight requests (XhrLoader.abortInternal):

xhr.onreadystatechange = null;
xhr.onprogress = null;
xhr.abort();

With vConsole enabled this throws an uncaught TypeError, because the XHR proxy wraps whatever value is assigned to onreadystatechange / onabort / ontimeout without a nullish check — the wrapper then calls value.apply(...) on null when the event fires:

Uncaught TypeError: Cannot read properties of null (reading 'apply')
    at XMLHttpRequest.<anonymous> (vconsole.min.js)
    at abortInternal (hls.min.js)
    ...

Any page playing HLS video via hls.js hits this on every stream switch / stop / destroy. Assigning null to these callbacks is a spec-compliant way to remove them, so the proxy should pass nullish values through instead of wrapping them.

Fix

In setOnReadyStateChange / setOnAbort / setOnTimeout: if the assigned value is nullish, Reflect.set it directly on the real XHR instead of installing a wrapper (a comment documents why).

Verification

Minimal repro (new VConsole() + the cleanup sequence above), run headless in Chromium:

Build	pageerror	User callbacks	Network panel
master	Cannot read properties of null (reading 'apply')	—	—
this patch	none	fired normally (status=200)	both XHRs tracked, status=200 (including one whose lifecycle went fn → null → fn)

Also verified that a callback re-assigned after being cleared with null is wrapped and tracked again as before.

[tencent-adm]

All committers have signed the CLA.