LibJS: Move intrinsics to the realm

Intrinsics, i.e. mostly constructor and prototype objects, but also
things like empty and new object shape now live on a new heap-allocated
JS::Intrinsics object, thus completing the long journey of taking all
the magic away from the global object.
This represents the Realm's [[Intrinsics]] slot in the spec and matches
its existing [[GlobalObject]] / [[GlobalEnv]] slots in terms of
architecture.

In the majority of cases it should now be possibly to fully allocate a
regular object without the global object existing, and in fact that's
what we do now - the realm is allocated before the global object, and
the intrinsics between both :^)

Userland/Libraries/LibJS/Runtime/Intl/Segmenter.cpp

@@ -62,7 +62,7 @@ Object* create_segment_data_object(VM& vm, Segmenter const& segmenter, Utf16View
     VERIFY(start_index < end_index);
 
     // 5. Let result be OrdinaryObjectCreate(%Object.prototype%).
-    auto* result = Object::create(realm, realm.global_object().object_prototype());
+    auto* result = Object::create(realm, realm.intrinsics().object_prototype());
 
     // 6. Let segment be the substring of string from startIndex to endIndex.
     auto segment = string.substring_view(start_index, end_index - start_index);