LibWeb+LibJS: Don't lazily construct web prototypes in cell constructors

It's not safe to allocate from the GC heap while in the constructor of a
GC heap cell. (Because if this ends up triggering a collection, we may
end up trying to call through an uninitialized vtable).

This was already done safely in the initialize() virtual in much of
LibJS and LibWeb. This patch moves the logic for prototypes, mixins,
and CSSStyleDeclaration as well.

Fixes a long-standing GC crash that was pretty easy to reproduce by
refreshing https://vercel.com/

Userland/Libraries/LibJS/Runtime/Object.h

@@ -187,6 +187,8 @@ public:
     template<typename T>
     bool fast_is() const = delete;
 
+    void set_prototype(Object*);
+
 protected:
     enum class GlobalObjectTag { Tag };
     enum class ConstructWithoutPrototypeTag { Tag };
@@ -198,8 +200,6 @@ protected:
     Object(ConstructWithPrototypeTag, Object& prototype);
     explicit Object(Shape&);
 
-    void set_prototype(Object*);
-
     // [[Extensible]]
     bool m_is_extensible { true };