.. and make JSGlobalObjectRef bg-serialized.

GetPropertyCell was implemented as:

 LookupIterator it(holder, isolate, name, LookupIterator::OWN);
 it.TryLookupCachedProperty();
 if (it.state() == LookupIterator::DATA) it.GetPropertyCell();

Due to concurrency requirements, we essentially have to reimplement
this entire path for use in a concurrent setting:

 - Reads in some cases have to use relaxed or acquire semantics.
 - The IsPendingAllocation predicate must be called on some objects
   before reading into them.
 - Repeated reads of the same field must be avoided due to the
   possibility of concurrent modifications.

This CL introduces two new methods:

ConcurrentLookupIterator::TryGetPropertyCell implements the outer
lookup logic, including the repeated lookup for accessors / cached
property names.

GlobalDictionary::TryFindPropertyCellForConcurrentLookupIterator is a
slightly modified HashTable::FindEntry which follows the above rules.

Bug: v8:7790
Change-Id: Ic9a52da766afdfedce8efcbda92876845a17eed9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2959616Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75467}