Fix remaining issues with bound checking (#23123)

While fixing these I've also changed the way we store addresses into
ByteArray#. Addr# are composed of two parts: a JavaScript array and an
offset (32-bit number).

Suppose we want to store an Addr# in a ByteArray# foo at offset i.
Before this patch, we were storing both fields as a tuple in the "arr"
array field:

  foo.arr[i] = [addr_arr, addr_offset];

Now we only store the array part in the "arr" field and the offset
directly in the array:

  foo.dv.setInt32(i, addr_offset):
  foo.arr[i] = addr_arr;

It avoids wasting space for the tuple.

(cherry picked from commit 2d5c1dde)