[weakrefs] Refine JSFinalizationRegistry field types

A WeakCell's unregister_token and holdings are passed in by the user,
and so should be JSAny. A FinalizationRegistry's callback function must
always be Callable.

Bug: v8:8179
Change-Id: I8e447ce4bfeba712594fc9a7c9923ce718adcd62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2129273Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66996}

src/objects/js-weak-refs.tq

@@ -8,7 +8,7 @@ bitfield struct FinalizationRegistryFlags extends uint31 {
 
 extern class JSFinalizationRegistry extends JSObject {
   native_context: NativeContext;
-  cleanup: Object;
+  cleanup: Callable;
   active_cells: Undefined|WeakCell;
   cleared_cells: Undefined|WeakCell;
   key_map: Object;
@@ -27,8 +27,8 @@ extern class JSFinalizationRegistryCleanupIterator extends JSObject {
 extern class WeakCell extends HeapObject {
   finalization_registry: Undefined|JSFinalizationRegistry;
   target: Undefined|JSReceiver;
-  unregister_token: Object;
-  holdings: Object;
+  unregister_token: JSAny;
+  holdings: JSAny;
 
   // For storing doubly linked lists of WeakCells in JSFinalizationRegistry's
   // "active_cells" and "cleared_cells" lists.