LibJS+js+test-js: Add GC debug mode that keeps cells "alive" as zombies

This patch adds a `-z` option to js and test-js. When run in this mode,
garbage cells are never actually destroyed. We instead keep them around
in a special zombie state.

This allows us to validate that zombies don't get marked in future GC
scans (since there were not supposed to be any more references!) :^)

Cells get notified when they become a zombie (via did_become_zombie())
and this is used by WeakContainer cells to deregister themselves from
the heap.

Userland/Libraries/LibJS/Runtime/FinalizationRegistry.h

@@ -34,6 +34,7 @@ public:
 
 private:
     virtual void visit_edges(Visitor& visitor) override;
+    virtual void did_become_zombie() override { deregister(); }
 
     FunctionObject* m_cleanup_callback { nullptr };
 

Userland/Libraries/LibJS/Runtime/WeakMap.h

@@ -30,6 +30,8 @@ public:
     virtual void remove_swept_cells(Badge<Heap>, Span<Cell*>) override;
 
 private:
+    virtual void did_become_zombie() override { deregister(); }
+
     HashMap<Cell*, Value> m_values; // This stores Cell pointers instead of Object pointers to aide with sweeping
 };
 

Userland/Libraries/LibJS/Runtime/WeakRef.h

@@ -31,6 +31,7 @@ public:
 
 private:
     virtual void visit_edges(Visitor&) override;
+    virtual void did_become_zombie() override { deregister(); }
 
     Object* m_value { nullptr };
     u32 m_last_execution_generation { 0 };

Userland/Libraries/LibJS/Runtime/WeakSet.h

@@ -30,6 +30,8 @@ public:
     virtual void remove_swept_cells(Badge<Heap>, Span<Cell*>) override;
 
 private:
+    virtual void did_become_zombie() override { deregister(); }
+
     HashTable<Cell*> m_values; // This stores Cell pointers instead of Object pointers to aide with sweeping
 };