LibJS: Avoid pointless transitions and metadata lookups in storage_set()

- Replace the misleading abuse of the m_transitions_enabled flag for the
  fast path without lookup with a new m_initialized boolean that's set
  either by Heap::allocate() after calling the Object's initialize(), or
  by the GlobalObject in its special initialize_global_object(). This
  makes it work regardless of the shape's uniqueness.
- When we're adding a new property past the initialization phase,
  there's no need to do a second metadata lookup to retrieve the storage
  value offset - it's known to always be the shape's property count
  minus one. Also, instead of doing manual storage resizing and
  assignment via indexing, just use Vector::append().
- When we didn't add a new property but are overwriting an existing one,
  the property count and therefore storage value offset doesn't change,
  so we don't have to retrieve it either.

As a result, Object::set_shape() is now solely responsible for updating
the m_shape pointer and is not resizing storage anymore, so I moved it
into the header.

Userland/Libraries/LibJS/Heap/Heap.h

@@ -6,6 +6,7 @@
 
 #pragma once
 
+#include <AK/Badge.h>
 #include <AK/HashTable.h>
 #include <AK/IntrusiveList.h>
 #include <AK/Noncopyable.h>
@@ -49,8 +50,10 @@ public:
         if constexpr (is_object)
             static_cast<Object*>(cell)->disable_transitions();
         cell->initialize(global_object);
-        if constexpr (is_object)
+        if constexpr (is_object) {
             static_cast<Object*>(cell)->enable_transitions();
+            static_cast<Object*>(cell)->set_initialized(Badge<Heap> {});
+        }
         return cell;
     }