Port e127f584

Original Commit Message:

    Handling of class constructors was moved from CallFunction to Call
    in [1].
    When reducing calls with spread we forward varargs directly to
    CallFunction, if we are spreading to inlined arguments or arguments of
    the outermost function.
    In that case we didn't check for class constructors and therefore didn't
    raise an exception.
    This CL adds checks for class constructors to all JSCall* nodes in
    JSCallReducer that missed them before.

    [1] https://crrev.com/c/3186434

R=pthier@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I02cba90369354f064201daa1bf8812e17cb2dc21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234040Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77480}