LibJS: Move native objects towards two-pass construction

To make sure that everything is set up correctly in objects before we
start adding properties to them, we split cell allocation into 3 steps:

1. Allocate a cell of appropriate size from the Heap
2. Call the C++ constructor on the cell
3. Call initialize() on the constructed object

The job of initialize() is to define all the initial properties.
Doing it in a second pass guarantees that the Object has a valid Shape
and can find its own GlobalObject.

Libraries/LibJS/Runtime/GlobalObject.h

@@ -72,7 +72,7 @@ private:
 template<typename ConstructorType>
 inline void GlobalObject::add_constructor(const FlyString& property_name, ConstructorType*& constructor, Object& prototype)
 {
-    constructor = heap().allocate<ConstructorType>();
+    constructor = heap().allocate<ConstructorType>(*this, *this);
     constructor->define_property("name", js_string(heap(), property_name), Attribute::Configurable);
     if (interpreter().exception())
         return;