LibJS: Always allocate ExecutionContext objects on the malloc heap

Instead of allocating these in a mixture of ways, we now always put
them on the malloc heap, and keep an intrusive linked list of them
that we can iterate for GC marking purposes.

Userland/Libraries/LibJS/Runtime/AsyncFunctionConstructor.cpp

@@ -45,7 +45,9 @@ ThrowCompletionOr<NonnullGCPtr<Object>> AsyncFunctionConstructor::construct(Func
     auto* constructor = vm.active_function_object();
 
     // 2. Let args be the argumentsList that was passed to this function by [[Call]] or [[Construct]].
-    auto& args = vm.running_execution_context().arguments;
+    MarkedVector<Value> args(heap());
+    for (auto argument : vm.running_execution_context().arguments)
+        args.append(argument);
 
     // 3. Return CreateDynamicFunction(C, NewTarget, async, args).
     return *TRY(FunctionConstructor::create_dynamic_function(vm, *constructor, &new_target, FunctionKind::Async, args));