[pull] master from ruby:master - #1371

Caller-splat dispatch creates a join result during type_specialize. A
following CFunc inline may use it before infer_types runs again, causing
ZJIT to infer the type of an untyped Param and panic.

Mark the join result as BasicObject and add regression tests for using it
with Hash#[]=.

Move receiver guards, argument emission, and SendDirect generation into a
callback invoked by dispatch_caller_splat. This keeps caller-splat CFG
construction together and allows adding one optimized path per profiled
length for polymorphic dispatch.

Use guards instead of a dynamic Send fallback and join block for monomorphic caller splats. Recompile on length mismatches so the call site can collect a new profile, and side-exit without recompiling for ruby2_keywords hashes.

Skip caller-splat specialization for final no-side-exit ISEQ versions.

Document that observing a second splat length makes the profile
non-monomorphic, so the next version keeps the dynamic Send instead of
emitting the same length guard. Add an opt test that verifies this before
the final-version policy applies.

Select the profiled caller-splat length in add_iseq_to_hir and attach it
to each Send before receiver dispatch creates its specialized arms.
type_specialize then uses the selected length to build each SendDirect
path.

This prepares caller-splat dispatch for supporting multiple profiled
lengths without making type_specialize responsible for building the
outer dispatch CFG.

We are out of imemo types because IMEMO_MASK uses 4 bits and we have 16
imemo types. This makes it not possible to experiment with new imemo types,
so we can increase it by one bit to have 16 more imemo types.