LibJS/Bytecode: Keep saved return value in call frame register

This fixes an issue where returning inside a `try` block and then
calling a function inside `finally` would clobber the saved return
value from the `try` block.

Note that we didn't need to change the base of register allocation,
since it was already 1 too high.

With this fixed, https://microsoft.com/edge loads in bytecode mode. :^)

Thanks to Luke for reducing the issue!

Userland/Libraries/LibJS/Tests/try-return-finally.js

@@ -0,0 +1,11 @@
+test("return from try followed by finally with function call inside", () => {
+    let value = (() => {
+        try {
+            return 1;
+        } finally {
+            (() => {})();
+        }
+    })();
+
+    expect(value).toBe(1);
+});