fix fast-array GC traversal of uninitialised slots

[Mcsky23]

Fixes #471

js_allocate_fast_array() used to set p->u.array.count = len immediately after allocation, regardless of the elements being uninitialised. If a GC pass runs during construction in methods that use this function (i.e. js_array_toReversed(), js_array_toSpliced(), js_array_toSorted(), js_array_with()), it could traverse uninitialised bytes and treat them as JSValues, potentially handling attacker-controlled leftover pointers.

The patch changes js_allocate_fast_array() to set p->u.array.count = 0 initially, leaving callers that update p->u.array.u.values[] to also increment this value progressively.