LibJS: Remove "uprooting" mechanism from garbage collector

The Heap::uproot_cell() API was used to implement markAsGarbage() which
was used in 3 tests to forcibly destroy a value, even if it had
references on the stack or elsewhere.

This patch rewrites the 3 tests that used this mechanism to be
structured in a way that allows garbage collection to collect the values
as intended without hacks. And now that the uprooting mechanism is no
longer needed, it's uprooted as well.

This fixes 3 test-js tests in bytecode mode. :^)

Userland/Libraries/LibJS/Heap/Heap.cpp

@@ -276,11 +276,6 @@ void Heap::mark_live_cells(HashTable<Cell*> const& roots)
         bytecode_interpreter->visit_edges(visitor);
 
     visitor.mark_all_live_cells();
-
-    for (auto& inverse_root : m_uprooted_cells)
-        inverse_root->set_marked(false);
-
-    m_uprooted_cells.clear();
 }
 
 bool Heap::cell_must_survive_garbage_collection(Cell const& cell)
@@ -427,11 +422,6 @@ void Heap::undefer_gc(Badge<DeferGC>)
     }
 }
 
-void Heap::uproot_cell(Cell* cell)
-{
-    m_uprooted_cells.append(cell);
-}
-
 void register_safe_function_closure(void* base, size_t size)
 {
     if (!s_custom_ranges_for_conservative_scan) {