LibJS: Move intrinsics to the realm

Intrinsics, i.e. mostly constructor and prototype objects, but also
things like empty and new object shape now live on a new heap-allocated
JS::Intrinsics object, thus completing the long journey of taking all
the magic away from the global object.
This represents the Realm's [[Intrinsics]] slot in the spec and matches
its existing [[GlobalObject]] / [[GlobalEnv]] slots in terms of
architecture.

In the majority of cases it should now be possibly to fully allocate a
regular object without the global object existing, and in fact that's
what we do now - the realm is allocated before the global object, and
the intrinsics between both :^)

Userland/Libraries/LibJS/Runtime/AsyncFunctionDriverWrapper.cpp

@@ -19,7 +19,7 @@ ThrowCompletionOr<Value> AsyncFunctionDriverWrapper::create(Realm& realm, Genera
 }
 
 AsyncFunctionDriverWrapper::AsyncFunctionDriverWrapper(Realm& realm, GeneratorObject* generator_object)
-    : Promise(*realm.global_object().promise_prototype())
+    : Promise(*realm.intrinsics().promise_prototype())
     , m_generator_object(generator_object)
     , m_on_fulfillment(NativeFunction::create(realm, "async.on_fulfillment"sv, [this](VM& vm) {
         return react_to_async_task_completion(vm, vm.argument(0), true);