ZJIT: Specialize #[] into an `rb_hash_aref` call if a profiled type is Hash

[k0kubun]

The interpreter inlines Hash#[] calls, but ZJIT doesn't. So enabling ZJIT would slow down ISEQs with Hash#[] calls. It should be at least as fast as what the interpreter does.

[k0kubun]

***ZJIT: Printing ZJIT statistics on exit***
Top-20 not inlined C methods (77.1% of total 5,830,892):
                                    Hash#[]: 1,455,985 (25.0%)
                              Class#current:   532,771 ( 9.1%)
                                   Array#[]:   499,244 ( 8.6%)
                               Kernel#is_a?:   338,941 ( 5.8%)
                         String#start_with?:   319,621 ( 5.5%)
                                   Hash#[]=:   251,427 ( 4.3%)
                 ObjectSpace::WeakKeyMap#[]:   139,416 ( 2.4%)
                                 Array#any?:    94,804 ( 1.6%)
                         Kernel#respond_to?:    86,634 ( 1.5%)
                                String#to_s:    81,629 ( 1.4%)
                             BasicObject#!=:    81,311 ( 1.4%)
                                String#hash:    79,148 ( 1.4%)
                              Regexp#match?:    79,038 ( 1.4%)
                        Kernel#block_given?:    78,830 ( 1.4%)
                       Module#clock_gettime:    74,657 ( 1.3%)
                    SQLite3::Statement#step:    62,187 ( 1.1%)
                   SQLite3::Statement#done?:    62,187 ( 1.1%)
                              TrueClass#===:    60,357 ( 1.0%)
                                  Hash#key?:    59,816 ( 1.0%)
                             FalseClass#===:    58,667 ( 1.0%)

This is the most frequently called (not dynamically dispatched or already inlined) C method on lobsters.

[aidenfoxivey]

Getting started on this now.