lib: add SafeArray to primordials and use it for FreeList

[ExE-Boss]

Refs: #36304 (comment)
Refs: #36565

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[Lxxyx]

Run Benchmark on my computer, seems the performance issues still exists.

                           confidence improvement accuracy (*)    (**)   (***)
 misc/freelist.js n=100000        ***    -92.46 %      ±1.94% ±2.61% ±3.46%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case there are 1 comparisons, you can thus
expect the following amount of false-positive results:
  0.05 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.01 false positives, when considering a   1% risk acceptance (**, ***),
  0.00 false positives, when considering a 0.1% risk acceptance (***)

[aduh95]

Benchmark CI: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/784/

[ExE-Boss]

Looks like the benchmark CI crashed: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/783/console

[aduh95]

Benchmark confirmed very poor performance results…

                            confidence improvement accuracy (*)   (**)  (***)
 misc/freelist.js n=100000        ***    -91.36 %       ±3.89% ±5.24% ±6.96%

[ExE-Boss]

If I had to guess, I’d say V8 is doing some inlining shenanigans when it detects a push or pop method on an ordinary array with %Array.prototype% in its [[Prototype]] internal slot.

---

By inlining the methods in #37649, I hope to make FreeList faster and resilient to mutation of %Array.prototype%.pop and %Array.prototype%.push