LibJS: Stop making shapes unique

We previously had a concept of unique shapes, which meant that they
couldn't be shared between multiple objects.

Object shapes became unique in three situations:

- They were the shape of the global object.
- They had more than 100 properties added to them.
- They had one or more properties deleted from them.

Unfortunately, unique shapes presented an annoying problem for inline
caches, and we added a "unique shape serial number" for being able to
tell that a unique shape had been mutated.

This patch gets rid of the concept of unique shapes, simplifying all
the caching code, since inline caches can now simply perform a shape
check and then we're good.

To make this possible, we now have the concept of delete transitions,
which occur when a property is deleted from a shape.

Note that this patch by itself introduces a performance regression in
some situtations, since we now create a lot more shapes, and marking
their property keys can be very heavy. This will be addressed in a
subsequent patch.

Userland/Libraries/LibJS/Bytecode/Executable.h

@@ -28,11 +28,9 @@ namespace JS::Bytecode {
 struct PropertyLookupCache {
     static FlatPtr shape_offset() { return OFFSET_OF(PropertyLookupCache, shape); }
     static FlatPtr property_offset_offset() { return OFFSET_OF(PropertyLookupCache, property_offset); }
-    static FlatPtr unique_shape_serial_number_offset() { return OFFSET_OF(PropertyLookupCache, unique_shape_serial_number); }
 
     WeakPtr<Shape> shape;
     Optional<u32> property_offset;
-    u64 unique_shape_serial_number { 0 };
 };
 
 struct GlobalVariableCache : public PropertyLookupCache {