RegExp: matchAll and replace with a function copy the whole input per match (quadratic)

Found in the post-#933 survey and re-executed today on a Debug build of main, timed externally. Each program runs over the ASCII subject 'ab '.repeat(N / 3):

node runs each in milliseconds. The survey measured peak memory as quadratic too: 238 MB for matchAll at 32k.

Cause: both loops hand the whole input to user-visible code as a fresh copy on every match.

• replace with a function builds the replacer's string argument with Value.strAlloc(self.arena, s) per match.
• The %RegExpStringIterator%'s next() calls regexpExecGeneric, which allocates a new string for exec on every call. The copy also drops the cell's cached ASCII flag, which the built-in exec uses for O(1) index conversion.

The generic match, replace and split loops, used when exec is overridden or subclassed, copy the same way.

A string has no identity, so passing the same value on every call is unobservable. Fix: a value-taking regexpExecGenericValue, one rooted string value per loop shared by exec and the replacer, and matchAll's next() passing its stored __str directly.

Non-ASCII subjects keep a separate O(n) cost per exec (UTF-16 to byte conversion without the ASCII shortcut). That is a larger change, left out of this issue.

Taking this; fix written, gating now.

Fixed in ad1ca10. Every exec loop now reuses one input string instead of copying it per match: matchAll's next(), the replacer's string argument, and the generic match/replace/split paths behind a user-defined exec.

Debug, median of 3, in seconds, on 'ab '.repeat(N/3):

A runtime case with 8 checks is pinned, and node passes all of them. The corpus is identical, with 0 flips. Non-ASCII subjects still pay a separate per-exec conversion cost, which is not in this change.