When TurboFan doesn't know anything about the receiver, it will
generally insert a call via CallFunctionTemplate builtin, which
does all the necessary checks. For this we don't need to be able
to deoptimize, so there's no need to have the speculation bit
available.

This restores the performance in the case of calling API methods
and accessors via `Function#call()`, i.e. like in this example:

```js
const hasAttribute = Element.prototype.hasAttribute;
// ...
hasAttribute.call(element, "bar");
```

Bug: v8:8820
Change-Id: Ic30719d7db75141023efc11d76180b001f871d28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615248
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61604}