fix use-after-free by scanning WeakMap entries during mark phase

additional correctness fixes:

• Mark await_coro in gc_mark_promise_handler via gc_mark_coroutine
• Defer active_async_coro unlinking until after js_resolve/reject_promise in sv_start_tla, sv_start_async_closure, and resume_coroutine_if_suspended, so the coroutine's VM is scanned if GC triggers during promise resolution
• Walk prototype chain in js_for_in_keys for spec-compliant for...in
• Refactor Object.assign to use an is_enumerable_prop helper