Clone ArrayBuffers and views in structuredClone

[OskarEichler]

Summary:

The structured-clone polyfill treats ArrayBuffer, DataView, and typed arrays as arbitrary objects, losing their internal data and type. Copy buffers through captured ArrayBuffer/Uint8Array intrinsics without consulting the source's constructor or species, reconstruct DataView and all 11 Hermes typed-array kinds through intrinsic constructors, and route every view buffer through clone memory so multiple views retain a shared cloned backing buffer.

Fixes #58218.

Changelog:

[GENERAL] [FIXED] - Clone ArrayBuffers, DataViews, and typed arrays with their bytes, offsets, lengths, and shared backing buffers.

Test Plan:

• Exact Hermes baseline first failed because an ArrayBuffer cloned as {}.
• Fixed focused Fantom suite: 34/34 passed before the latest hardening; the updated exact-head suite is running in CI.
• Regression covers distinct identity, exact constructors, and values for all 11 supported typed-array kinds; shared offset Uint8Array/DataView backing memory; buffer bytes/offsets/lengths; shadowed source slice/typed-array constructor; and an ArrayBuffer constructor getter that throws if species lookup occurs.
• Fresh yarn flow-check: 0 errors.
• Targeted ESLint, Prettier, an intrinsic byte-copy runtime check, and git diff --check passed.

Transfer support is unchanged and remains outside this patch. No UI change; screenshots are not applicable.

[OskarEichler]

The full re-review found one additional species-constructor edge case, fixed in 566f17f. ArrayBuffer.prototype.slice can still consult a source buffer's overridden constructor[Symbol.species], execute user code, and return the wrong subclass. The implementation now allocates a plain ArrayBuffer from the captured intrinsic byte-length getter and copies bytes through the captured Uint8Array intrinsic. The regression makes the source constructor getter throw, proving it is never consulted. Flow reports 0 errors; targeted ESLint, Prettier, the intrinsic-copy runtime check, and diff validation pass. Exact-head Fantom CI is now running.

[OskarEichler]

The latest CI run exposed a Flow-only regression in the species-safe ArrayBuffer copy: Object.getOwnPropertyDescriptor inferred the captured byteLength getter as returning unknown. Fixed in 7065834 by supplying the descriptor's number type at the capture boundary. Full yarn flow-check now reports 0 errors; focused Prettier, ESLint, and diff validation also pass.