Optimize array.reduce, array.reduceRight to sealed, frozen object

Use FastJSArrayForRead pattern.
Add test of array.reduce, array.reduceRight for non-extensible, sealed, frozen objects similar to mjsunit/array-reduce.js

~3x perf improvement in JSTests/ObjectFreeze micro-benchmark
Before:
ArrayReduce
ArrayReduce-Numbers(Score): 0.0740
ArrayReduceRight
ArrayReduceRight-Numbers(Score): 0.0767

After:
ArrayReduce
ArrayReduce-Numbers(Score): 0.249
ArrayReduceRight
ArrayReduceRight-Numbers(Score): 0.261


Bug: v8:6831
Change-Id: I98f54f010256993fcd05bb24be968fb2d0f5c966
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1656851
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62158}

src/builtins/array-reduce-right.tq

@@ -111,9 +111,9 @@ namespace array {
       labels Bailout(Number, Object) {
     let accumulator = initialAccumulator;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(len - 1, accumulator);
-    const fastO =
-        Cast<FastJSArray>(o) otherwise goto Bailout(len - 1, accumulator);
-    let fastOW = NewFastJSArrayWitness(fastO);
+    const fastO = Cast<FastJSArrayForRead>(o)
+        otherwise goto Bailout(len - 1, accumulator);
+    let fastOW = NewFastJSArrayForReadWitness(fastO);
 
     // Build a fast loop over the array.
     for (let k: Smi = smiLen - 1; k >= 0; k--) {

src/builtins/array-reduce.tq

@@ -111,8 +111,9 @@ namespace array {
     const k = 0;
     let accumulator = initialAccumulator;
     Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
-    const fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k, accumulator);
-    let fastOW = NewFastJSArrayWitness(fastO);
+    const fastO =
+        Cast<FastJSArrayForRead>(o) otherwise goto Bailout(k, accumulator);
+    let fastOW = NewFastJSArrayForReadWitness(fastO);
 
     // Build a fast loop over the array.
     for (let k: Smi = 0; k < len; k++) {