LibJS: Add inline caching for adding new own properties to objects

We already had IC support in PutById for the following cases:
- Changing an existing own property
- Calling a setter located in the prototype chain

This was enough to speed up code where structurally identical objects
(same shape) are processed in a loop:
```js
const arr = [{ a: 1 }, { a: 2 }, { a: 3 }];
for (let obj of arr) {
    obj.a += 1;
}
```

However, creating structurally identical objects in a loop was still
slow:
```js
for (let i = 0; i < 10_000_000; i++) {
    const o = {};
    o.a = 1;
    o.b = 2;
    o.c = 3;
}
```

This change addresses that by adding a new IC type that caches both the
source and target shapes, allowing property additions to be fast-pathed
by directly jumping to the shape that already includes the new property.

Libraries/LibJS/Bytecode/Executable.h

@@ -28,6 +28,16 @@ namespace JS::Bytecode {
 struct PropertyLookupCache {
     static constexpr size_t max_number_of_shapes_to_remember = 4;
     struct Entry {
+        enum class Type {
+            Empty,
+            AddOwnProperty,
+            ChangeOwnProperty,
+            GetOwnProperty,
+            ChangePropertyInPrototypeChain,
+            GetPropertyInPrototypeChain,
+        };
+        Type type { Type::Empty };
+        WeakPtr<Shape> from_shape;
         WeakPtr<Shape> shape;
         Optional<u32> property_offset;
         WeakPtr<Object> prototype;