Support lowering of Function.prototype.call in the JSBuiltinReducer,
which is actually straightforward because of the way we represent JS
calls in TurboFan.  Currently we cannot inline the actual target yet,
since inlining still runs before typed lowering, but that will be
possible as well soon(ish).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1439533002

Cr-Commit-Position: refs/heads/master@{#31938}