[wasm] Introduce WasmTrustedInstanceData

This CL moves most data from the WasmInstanceObject to a new
WasmTrustedInstanceData. As the name suggests, this new object is
allocated in the trusted space and can hence hold otherwise-unsafe data
(like direct pointers). As the Wasm instance was still storing some
unsafe pointers, this CL closes holes in the V8 sandbox, and allows us
to land follow-up refactorings to remove more indirections for
sandboxing (potentially after moving more data structures to the trusted
space).

The general idea is that during execution we mostly work with the
WasmTrustedInstanceData object. This is passed as a direct pointer to
Wasm functions and is stored in Wasm frames.
The WasmInstanceObject is the JS-exposed wrapper, which also holds
user-defined properties and elements.

See the design doc (linked from the tracking bug) for all the details.

R=ahaas@chromium.org, saelo@chromium.org

Bug: v8:14499
Change-Id: I44fc81078d0785db1507ffcad1c1aaca39351e45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5130974
Reviewed-by: Samuel Groß <saelo@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Eric Leese <leese@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91680}