When using the StringForwardingTable for all strings, string shapes can
change during GC. This led to an issue when a ConsString was
transitioned to a ThinString (and potentially shortcutted to
InternalizedString) while flattening.

Bug: chromium:1335826, chromium:1329726
Change-Id: Ide243a5e24fd41374053972fb7bab8217d7a14fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3705377Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81131}