[web snapshot] Fix GC issues when deserializing functions

This CL fixes WebSnapshotDeserializer::DeserializeFunctions(), so that
the new Script is created after both the SharedFunctionInfoTable and
SharedFunctionInfo are allocated.

Also, this CL re-enables mjsunit tests for web snapshots (disabled in
https://chromium-review.googlesource.com/c/v8/v8/+/2931806).

Bug: v8:11842, v8:11525, v8:11706
Change-Id: I13503eab3fa70b128ba1faae75eed62b6c5bb636
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933145


Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#74923}