LibJS: Add a finalization pass to the garbage collector

Doing things in the destructor of a GC-allocated object isn't always
safe, in case it involves accessing other GC-allocated objects.
If they were already swept by GC, we'd be poking into freed memory.

This patch adds a separate finalization pass where GC calls finalize()
on every unmarked cell that's about to be deleted.

It's safe to access other GC objects in finalize(), even if they're
also unmarked.

Userland/Libraries/LibJS/Heap/Cell.h

@@ -77,6 +77,9 @@ public:
     virtual bool is_environment() const { return false; }
     virtual void visit_edges(Visitor&) { }
 
+    // This will be called on unmarked objects by the garbage collector in a separate pass before destruction.
+    virtual void finalize() { }
+
     Heap& heap() const;
     VM& vm() const;