mshtml: Use query_interface in the dispex vtbl for MutationObserver.