[compiler] Fix for false positive mutation of destructured spread object

[josephsavona]

When destructuring, spread creates a new mutable object that captures part of the original rvalue. This new value is safe to modify.

When making this change I realized that we weren't inferring array pattern spread as creating an array (in type inference) so I also added that here.

[josephsavona]

Closes #33781

[josephsavona]

this is the example where i realized we weren't inferring array pattern spread as an array type

[mofeiZ]

Ahh makes sense. MergeReactiveScopesThatInvalidateTogether uses type info as a proxy for whether something was newly created, which currently works due to how we infer types

[mofeiZ]

Makes sense! Thanks for the local mutation test case to check that we correctly infer mutations on object spread! I guess we don't gain much from inferring BuiltInObjectId for destructured object spreads. The only benefits seem... arguably incorrect (objects can define mutating toString properties that override the prototype) or not as important.

1. inference of object properties, which is currently only the (not very helpful) toString method from the Object prototype. We could also add hasOwnProperty, but that's about it.

function Component({prop}) {
   'use memo';
  const {value, ...rest} = prop;
  // we can infer that `toString` does not mutate its operand
  return rest.toString();
}

2. MergeReactiveScopesThatInvalidateTogether

function Component({prop}) {
   'use memo';
  const {value, ...rest} = prop;
  // we can merge the scope that creates {rest} with the destructuring scope
  return {rest}
}

[josephsavona]

Yeah, fair. Let's come back to the object case in a follow-up, as a potential optimization for scope merging. Scope merging in general could use some work to handle a few more common cases like an intermediate StoreLocal btw scopes.