Merged: [maglev] Don't find property load continuations across try-catch blocks

The search for polymorphic property load continuations now stops at
try-catch boundaries. Previously, it would scan across them, which could
cause it to visit the try-block start once in the first continuation,
and cause the second continuation to think it's inside the handler.

Drive-by, clean-up the predicate around merge points (to be more
explicit about loop headers only not having merge points when loop
peeling), and DCHECK that the source position table state doesn't
change, since there's nothing in the continuation finding that would
make it change.

Includes followup fix in https://crrev.com/c/7035734:
IsOffsetAPolymorphicContinuationInterrupt should return _true_ at merge
points etc., not _false_

(cherry picked from commit d05f2fc4787441d97208c5ecf5364dad48211aef)
(cherry picked from commit 5b4749d758543c2a0cd755af5d58b7e661ab61e7)

Fixed: 449549329
Change-Id: I70ae036247fa863ab612d22b90fbe663fdc15104
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062521
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/branch-heads/14.2@{#27}
Cr-Branched-From: 37f82dbb9f640dc5eea09870dd391cd3712546e5-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089b861336cf4b3887edfd3fdd280b23b5dd-refs/heads/main@{#102804}