LibJS/Bytecode: Invalidate inline caches on unique shape mutation

Since we can't rely on shape identity (i.e its pointer address) for
unique shapes, give them a serial number that increments whenever a
mutation occurs.

Inline caches can then compare this serial number against what they
have seen before.

Userland/Libraries/LibJS/Runtime/Object.h

@@ -48,6 +48,7 @@ struct CacheablePropertyMetadata {
     };
     Type type { Type::NotCacheable };
     Optional<u32> property_offset;
+    u64 unique_shape_serial_number { 0 };
 };
 
 class Object : public Cell {