LibJS: Make array-like Get access on ordinary objects much faster

This patch adds a fast path to the GetByValue bytecode op that bypasses
a ton of things *if* a set of assumptions hold:

- The property key must be a non-negative Int32
- The base object must not interfere with indexed property access
- The property key must already be present as an own property
- The existing value must not have any accessors defined

If this holds (which it should in the common case), we can poke directly
at the indexed property storage and save a boatload of time.

10% speed-up on the entire Kraken benchmark :^)
(including: 31% speed-up on Kraken/audio-dft.js)
(including: 23% speed-up on Kraken/stanford-crypto-aes.js)

Userland/Libraries/LibJS/Bytecode/Interpreter.cpp

@@ -1530,6 +1530,19 @@ ThrowCompletionOr<void> GetByValue::execute_impl(Bytecode::Interpreter& interpre
 
     auto base_value = interpreter.reg(m_base);
     auto object = TRY(base_object_for_get(interpreter, base_value));
+
+    // OPTIMIZATION: Fast path for simple Int32 indexes in array-like objects.
+    if (property_key_value.is_int32()
+        && property_key_value.as_i32() >= 0
+        && !object->may_interfere_with_indexed_property_access()
+        && object->indexed_properties().has_index(property_key_value.as_i32())) {
+        auto value = object->indexed_properties().get(property_key_value.as_i32())->value;
+        if (!value.is_accessor()) {
+            interpreter.accumulator() = value;
+            return {};
+        }
+    }
+
     auto property_key = TRY(property_key_value.to_property_key(vm));
 
     if (base_value.is_string()) {