Missing coverage: Resizable / GrowableSharedArrayBuffers: parameter conversion resizes the underlying buffer

In most TypedArray.prototype funcs, it's possible that the underlying ArrayBuffer gets resized when we're converting the parameters.

E.g., for TypedArray.prototype.fill:

1. Let O be the this value.
2. Perform ? ValidateTypedArray(O).
3. Let len be O.[[ArrayLength]]. <<< Reading length here
4. If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
5. Otherwise, set value to ? ToNumber(value).
6. Let relativeStart be ? ToIntegerOrInfinity(start). <<<< This might resize the buffer

Further, some TypedArray.prototype funcs take a callback as a parameter and that callback might resize the AB.

v8 has tests for these cases here:
https://source.chromium.org/chromium/chromium/src/+/main:v8/test/mjsunit/typedarray-resizablearraybuffer.js;l=1?ss=chromium

(Search for "ParameterConversionResizes" and "GrowMidIteration" / "ShrinkMidIteration".)

Getting this right is security critical, so would be great to have test262 tests.

cc @jugglinmike

Start by reviewing the issue's TypedArray.prototype.fill example and the linked V8 resizablearraybuffer.js tests, searching for “ParameterConversionResizes”, “GrowMidIteration”, and “ShrinkMidIteration”. Add test262 coverage for parameter-conversion and callback cases that resize the underlying ArrayBuffer, and verify the relevant tests pass.