Port 1ef6c437

Original Commit Message:

    This CL changes the poisoning in the interpreter to use the
    infrastructure used in the JIT.

    This does not change the original flag semantics:

    --branch-load-poisoning enables JIT mitigations as before.

    --untrusted-code-mitigation enables the interpreter mitigations
      (now realized using the compiler back-end), but does not enable
      the back-end based mitigations for the Javascript JIT. So in effect
      --untrusted-code-mitigation makes the CSA pipeline for bytecode handlers
      use the same mechanics (including changed register allocation) that
      --branch-load-poisoning enables for the JIT.

R=tebbi@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I46ee60541c48ad1e9c5ca1c2aac0d89d81c65333
Reviewed-on: https://chromium-review.googlesource.com/981935Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52258}