Unship spread calls and spread arrays

Return both --harmony-spreadcalls and --harmony-spread-arrays
to staging, in preparation for disabling those features on
the M45 branch.

There are no known bugs in spread calls, but without rest and spread
arrays it seems appropriate to leave all of them out rather than
only supporting a singular use of the '...' operator.

BUG=v8:4298
LOG=y

Review URL: https://codereview.chromium.org/1230773005

Cr-Commit-Position: refs/heads/master@{#29657}

src/flag-definitions.h

@@ -202,14 +202,14 @@ DEFINE_BOOL(legacy_const, true, "legacy semantics for const in sloppy mode")
 #define HARMONY_STAGED(V)                                       \
   V(harmony_tostring, "harmony toString")                       \
   V(harmony_concat_spreadable, "harmony isConcatSpreadable")    \
-  V(harmony_rest_parameters, "harmony rest parameters")
+  V(harmony_rest_parameters, "harmony rest parameters")         \
+  V(harmony_spreadcalls, "harmony spread-calls")                \
+  V(harmony_spread_arrays, "harmony spread in array literals")
 
 // Features that are shipping (turned on by default, but internal flag remains).
 #define HARMONY_SHIPPING(V)                                             \
   V(harmony_arrow_functions, "harmony arrow functions")                 \
   V(harmony_computed_property_names, "harmony computed property names") \
-  V(harmony_spreadcalls, "harmony spread-calls")                        \
-  V(harmony_spread_arrays, "harmony spread in array literals")          \
   V(harmony_unicode, "harmony unicode escapes")                         \
   V(harmony_object, "harmony Object methods")