This introduces a new keyword "shape" in addition to "class",
which allows the definition of a type that extends a JSObject
subclass and specifies one or several maps with statically
known in-object properties.
Differences compared to normal classes:
- Shapes are transient since they specify maps instead of
  instance types.
- Shapes have a known size.
- Fields of shapes are always in-object properties. In particular,
  this means that their offset is after kHeaderSize.
- It's forbidden to inherited from shapes.
- Since shapes usually specify NativeContext-dependent maps, it's
  not possible to write runtime type-checks for them. Thus this CL
  avoids mapping them to their own TNode type, as the CAST macro
  won't work properly. We had runtime-checks for some of them
  nevertheless, some of them scarily confusing like
  IsJSSloppyArgumentsObject, that actually just checked the instance
  type.

Drive-by cleanups and simplifications:
- Allow subclassing from non-abstract classes and remove
  @dirtyInstantiatedAbstractClass. This attribute stems from a mis-
  conception of how instance types work, and with this change it
  ceases to have semantic influence.
- Replace the existing JSArgumentsObject subclasses into two shapes.
  JSArgumentsObjectWithLength had to be removed since shapes don't
  support subclassing.
- Place kHeaderSize correctly for objects with indexed fields.

Design doc:
https://docs.google.com/document/d/1zPy2ZYfNFjeEuw6Mz3YJA-GaPGbdcSYam3SrS7ETzRU

Bug: v8:8944

Change-Id: Iabf185ccd27d0900e0890539a7fe9eaa8bf2d50e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917140
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65108}