[es6] Ship spread

This enables both --harmony-spreadcalls and --harmony-spread-arrays

BUG=v8:3018
LOG=N
R=caitpotter88@gmail.com, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1177223005

Cr-Commit-Position: refs/heads/master@{#29168}

src/flag-definitions.h

@@ -200,8 +200,6 @@ DEFINE_IMPLICATION(es_staging, harmony)
 #define HARMONY_STAGED(V)                                      \
   V(harmony_arrays, "harmony array methods")                   \
   V(harmony_rest_parameters, "harmony rest parameters")        \
-  V(harmony_spreadcalls, "harmony spread-calls")               \
-  V(harmony_spread_arrays, "harmony spread in array literals") \
   V(harmony_tostring, "harmony toString")
 
 // Features that are shipping (turned on by default, but internal flag remains).
@@ -210,6 +208,8 @@ DEFINE_IMPLICATION(es_staging, harmony)
   V(harmony_classes, "harmony classes (implies object literal extension)") \
   V(harmony_computed_property_names, "harmony computed property names")    \
   V(harmony_object_literals, "harmony object literal extensions")          \
+  V(harmony_spreadcalls, "harmony spread-calls")                           \
+  V(harmony_spread_arrays, "harmony spread in array literals")             \
   V(harmony_unicode, "harmony unicode escapes")                            \
   V(harmony_object, "harmony Object methods")