fix(swingset): disable metering around GC-sensitive operations

[warner]

When a swingset kernel is part of a consensus machine, the visible state must
be a deterministic function of userspace activity. Every member kernel must
perform the same set of operations.

However we are not yet confident that the timing of garbage collection will
remain identical between kernels that experience different patterns of
snapshot+restart. In particular, up until recently, the amount of "headroom"
in the XS memory allocator was reset upon snapshot reload: the new XS engine
only allocates as much RAM as the snapshot needs, whereas before the snapshot
was taken, the RAM footprint could have been larger (e.g. if a large number
of objects we allocated and then released), leading to more "headroom".
Automatic GC is triggered by an attempt to allocate space which cannot be
satisfied by this headroom, so it will happen more frequently in the
post-reload engine than before the snapshot.

To accommodate differences in GC timing between kernels that are otherwise
operating in consensus, this commit introduces the "unmetered box": a span of
execution that does not count against the meter. We take all of the liveslots
operations that might be sensitive to the engine's GC behavior and put them
"in" the box.

This includes any code that calls deref() on the WeakRefs used in
slotToVal, because the WeakRef can change state from "live" to "dead" when
GC is provoked, which is sensitive to more than just userspace behavior.

closes #3458

[FUDCo]

This seems pretty terrible from a legibility perspective, and so I have to wonder if a notationally less awkward approach is possible (can't think of one, but we are collectively very clever...). Further, I'm more than a little concerned by the somewhat ad hoc nature of the selection of things to be wrapped. I'm wondering if there's some way to just meter user code and leave everything that's part of liveslots unmetered.

[warner]

abandoned in favor of #3667