[turbofan] Harden type-based elimination of MaybeGrowFastElements

... against potential typer bugs. Instead of simply eliminating the
operation, insert an aborting bounds check instead.

Also move this transformation out of SimplifiedLowering, which is
already complex enough without doing these kinds of optimizations.
Unfortunately this will result in some missed optimization opportunities
because we may have more precise types during SimplifiedLowering. Let's
see if this makes a visible performance difference.

Change-Id: I9c16ad33104c29fdba39bf729d69ee03fc9797d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2129633
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67222}