LibJS: Don't force property table reification on Shape::property_count()

Previously whenever you would ask a Shape how many properties it had,
it would reify the property table into a HashMap and use HashMap::size()
to answer the question.

This can be a huge waste of time if we don't need the property table for
anything else, so this patch implements property count tracking in a
separate integer member of Shape. :^)

Libraries/LibJS/Runtime/Shape.h

@@ -112,6 +112,7 @@ private:
     bool m_unique { false };
     Object* m_prototype { nullptr };
     TransitionType m_transition_type { TransitionType::Invalid };
+    size_t m_property_count { 0 };
 };
 
 }