LibJS: Move native objects towards two-pass construction

To make sure that everything is set up correctly in objects before we
start adding properties to them, we split cell allocation into 3 steps:

1. Allocate a cell of appropriate size from the Heap
2. Call the C++ constructor on the cell
3. Call initialize() on the constructed object

The job of initialize() is to define all the initial properties.
Doing it in a second pass guarantees that the Object has a valid Shape
and can find its own GlobalObject.

Libraries/LibJS/Runtime/Accessor.h

@@ -37,7 +37,7 @@ class Accessor final : public Cell {
 public:
     static Accessor* create(Interpreter& interpreter, Function* getter, Function* setter)
     {
-        return interpreter.heap().allocate<Accessor>(getter, setter);
+        return interpreter.heap().allocate<Accessor>(interpreter.global_object(), getter, setter);
     }
 
     Accessor(Function* getter, Function* setter)