Port 06a2c2e0

Original Commit Message:

    We currently allow OSR (On-Stack Replacement) of arbitrarily deep return
    addresses. This is in direct violation of Intel CET's shadow stack,
    which we plan to enable eventually.

    This change works around this by postponing OSR until after we return to
    the old code. The main changes are:
    - Reserve a slot in Liftoff frames to store the OSR target,
    - Skip the return address modification, and instead store the new code
    pointer in the dedicated slot,
    - Upon returning to the old code, check the slot and do an indirect jump
    to the new code if needed.

    CET also prevents indirect jumps to arbitrary locations, so the last
    point is also a CET violation. Valid indirect jump targets must be
    marked with the ENDBRANCH instruction, which I will do in a follow-up
    CL.

R=thibaudm@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Id972de1ba7556474cb00b377ea3a38eb4332eae3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2828870Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73984}