lib: inline `Array` operations in `FreeList` methods

[ExE-Boss]

This inlines a simplified behaviour of %Array.prototype.pop% and %Array.prototype.push% in FreeList’s methods and sets the prototype of the list to null so that OrdinarySetWithOwnDescriptor doesn’t walk up the prototype chain.

This avoids depending on user code not mutating %Array.prototype%.pop and %Array.prototype%.push.

---

Refs: https://github.com/nodejs/node/pull/36565 Refs: https://github.com/nodejs/node/pull/36600

If I had to guess, I’d say V8 is doing some inlining shenanigans when it detects a push or pop method on an ordinary array with %Array.prototype% in its [[Prototype]] internal slot.

---

/cc @aduh95 @Lxxyx

[aduh95]

Benchmark CI: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/957/

Benchmark results still show regression:

                         confidence improvement accuracy (*)   (**)  (***)
misc/freelist.jsn=100000        ***    -86.53 %       ±1.04% ±1.40% ±1.84%

[aduh95]

Benchmark CI: https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/959/

                          confidence improvement accuracy (*)   (**)  (***)
 misc/freelist.jsn=100000        ***    -90.38 %       ±1.42% ±1.91% ±2.53%