LibJS: Let Array.prototype.toSpliced throw RangeError for len <= 2^53-1

This aligns it with the spec again, it was clarified that the additional
range check before ArrayCreate is intentional:
https://github.com/tc39/proposal-change-array-by-copy/issues/94

Also cast the final variable to an u64 instead of size_t after we have
determined that it is safe to do so, as that's what Array::create()
takes now.

Userland/Libraries/LibJS/Tests/builtins/Array/Array.prototype.toSpliced.js

@@ -97,4 +97,11 @@ describe("errors", () => {
             Array.prototype.toSpliced.call(a, 0, 0, "foo");
         }).toThrowWithMessage(TypeError, "Maximum array size exceeded");
     });
+
+    test("invalid array length", () => {
+        const a = { length: 2 ** 32 - 1 };
+        expect(() => {
+            Array.prototype.toSpliced.call(a, 0, 0, "foo");
+        }).toThrowWithMessage(RangeError, "Invalid array length");
+    });
 });