LibJS: Start implementing object shapes

This patch adds JS::Shape, which implements a transition tree for our
Object class. Object property keys, prototypes and attributes are now
stored in a Shape, and each Object has a Shape.

When adding a property to an Object, we make a transition from the old
Shape to a new Shape. If we've made the same exact transition in the
past (with another Object), we reuse the same transition and both
objects may now share a Shape.

This will become the foundation of inline caching and other engine
optimizations in the future. :^)

Libraries/LibJS/Forward.h

@@ -43,6 +43,7 @@ class Interpreter;
 class Object;
 class PrimitiveString;
 class ScopeNode;
+class Shape;
 class Statement;
 class Value;
 enum class DeclarationType;