Fix readonly array descriptors not throwing TypeError in strict mode

[Copilot]

Summary

Fix TryWriteExistingDense bypassing writability checks on frozen/locked array elements.

Details

When array elements were made non-writable via FastSetProperty + PreventExtensions, the SimpleAssignmentExpression.SetValue fast path called TryWriteExistingDense which only checked slot occupancy—never descriptor writability. This silently overwrote (or appeared to overwrite) read-only elements without throwing in strict mode.

Fixes:

• ArrayInstance.TryWriteExistingDense: bail out when _sparse has a non-writable descriptor for the index, forcing fallback to the full PutValue path that enforces strict-mode TypeError.
• ArrayLikeWrapper.Set: handle numeric index writes directly with CanWrite/Extensible guards (consistent with how ObjectWrapper.Set handles string-keyed properties), preventing the SetSlow fallback from incorrectly returning true.

Repro from the issue:

var engine = new Engine(x => x.Strict());
// ... wrap dictionary with object[1] property, lock descriptors, PreventExtensions ...
engine.Evaluate("context.property[0] = {};"); // should throw, was silent

Linked issue

Closes #2541

Test plan

• Added or updated unit tests in Jint.Tests
• Ran dotnet test --configuration Release locally
• For ECMAScript spec changes: ran Jint.Tests.Test262 and confirmed no regressions (99,260 pass)
• For interop changes: covered in Jint.Tests/Runtime/Interop
• For perf changes: included before/after numbers from Jint.Benchmark

Breaking change?

No. Restores pre-4.10.0 behavior where writing to non-writable array elements throws in strict mode.