Bug 1640592: Don't allocate named capture groups template in the nursery r=tcampbell

The lifetime of the template is tied to the lifetime of the RegExpShared, and every RegExpShared is tenured, so there's no point allocating this in the nursery.

Depends on D76754

Differential Revision: https://phabricator.services.mozilla.com/D76755

js/src/vm/RegExpObject.cpp

@@ -1150,7 +1150,7 @@ bool RegExpShared::initializeNamedCaptures(JSContext* cx, HandleRegExpShared re,
 
   // Create a plain template object.
   RootedPlainObject templateObject(
-      cx, NewObjectWithGivenProto<PlainObject>(cx, nullptr));
+      cx, NewTenuredObjectWithGivenProto<PlainObject>(cx, nullptr));
   if (!templateObject) {
     return false;
   }