LibJS: Make PromiseCapability GC-allocated

A struct with three raw pointers to other GC'd types is a pretty big
liability, let's just turn this into a Cell itself.
This comes with the additional benefit of being able to capture it in
a lambda effortlessly, without having to create handles for individual
members.

Userland/Libraries/LibJS/Runtime/AsyncFunctionDriverWrapper.cpp

@@ -59,7 +59,8 @@ ThrowCompletionOr<Value> AsyncFunctionDriverWrapper::react_to_async_task_complet
     if (TRY(result.get(vm, vm.names.done)).to_boolean())
         return promise;
 
-    return promise->perform_then(m_on_fulfillment, m_on_rejection, PromiseCapability { promise, m_on_fulfillment, m_on_rejection });
+    auto promise_capability = PromiseCapability::create(vm, promise, m_on_fulfillment, m_on_rejection);
+    return promise->perform_then(m_on_fulfillment, m_on_rejection, promise_capability);
 }
 
 void AsyncFunctionDriverWrapper::visit_edges(Cell::Visitor& visitor)