[sandbox][leaptiering] Allocate JSDispatchTable entry for FeedbackCells

With this CL, FeedbackCells now own an entry in the JSDispatchTable.
The entry is not yet populated, but it is already managed by the GC. In
follow-up CLs, the entry handle will be populated to point to the
current code for the functions sharing the FeedbackCell.

Bug: 40931165, 42204201
Change-Id: I4f2cb6850b31ba7fc7af7460a3f8e9d5a0b9ed65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5677828


Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#95130}