LibJS: Move native objects towards two-pass construction

To make sure that everything is set up correctly in objects before we
start adding properties to them, we split cell allocation into 3 steps:

1. Allocate a cell of appropriate size from the Heap
2. Call the C++ constructor on the cell
3. Call initialize() on the constructed object

The job of initialize() is to define all the initial properties.
Doing it in a second pass guarantees that the Object has a valid Shape
and can find its own GlobalObject.

Libraries/LibJS/Runtime/Uint8ClampedArray.cpp

@@ -35,7 +35,7 @@ namespace JS {
 Uint8ClampedArray* Uint8ClampedArray::create(GlobalObject& global_object, u32 length)
 {
     auto& interpreter = global_object.interpreter();
-    return interpreter.heap().allocate<Uint8ClampedArray>(length, *global_object.array_prototype());
+    return interpreter.heap().allocate<Uint8ClampedArray>(global_object, length, *global_object.array_prototype());
 }
 
 Uint8ClampedArray::Uint8ClampedArray(u32 length, Object& prototype)