LibJS: Do not allocate in Set's constructor

We are currently allocating in Set's constructor to create the set's
underlying Map. This can cause GC to occur before the member is actually
initialized, thus we will crash in Set::visit_edges trying to visit a
member that does not exist.

Instead, create the Map in Set::initialize, where we can allocate. Also
change Map to be stored as a normal JS heap-allocated object, rather
than as a stack variable.

Userland/Libraries/LibJS/Runtime/Map.h

@@ -19,9 +19,6 @@ namespace JS {
 class Map : public Object {
     JS_OBJECT(Map, Object);
 
-    // NOTE: This awkwardness is due to Set using a Map internally.
-    friend class Set;
-
 public:
     static Map* create(Realm&);