LibJS: Move native objects towards two-pass construction

To make sure that everything is set up correctly in objects before we
start adding properties to them, we split cell allocation into 3 steps:

1. Allocate a cell of appropriate size from the Heap
2. Call the C++ constructor on the cell
3. Call initialize() on the constructed object

The job of initialize() is to define all the initial properties.
Doing it in a second pass guarantees that the Object has a valid Shape
and can find its own GlobalObject.

Libraries/LibJS/Runtime/Symbol.cpp

@@ -42,7 +42,7 @@ Symbol::~Symbol()
 
 Symbol* js_symbol(Heap& heap, String description, bool is_global)
 {
-    return heap.allocate<Symbol>(move(description), is_global);
+    return heap.allocate<Symbol>(heap.interpreter().global_object(), move(description), is_global);
 }
 
 Symbol* js_symbol(Interpreter& interpreter, String description, bool is_global)