Bug 1792228: Use LoadObject instead of LoadProto for proto shape guards r=jandem

We noticed this while looking at the CacheIR generated for an add-slot stub.

The depth threshold of 4 was picked by browsing around on the web and dumping the observed depth. 4 is enough to cover 95%+ of the cases I saw.

There are a couple of other places where we use LoadProto: the no-teleporting case in `GeneratePrototypeGuards`, and `ShapeGuardPrototypeChainForCrossCompartmentHolder`. They didn't show up in my experiments, so I left them alone for now.

Differential Revision: https://phabricator.services.mozilla.com/D158037