d2d61f8871a4dfacef8f0ba59b004834c2e9649d  [JSC] Use std::span in multiplication in JSBigInt while not increasing assertions

Classified as not security-relevant.
Triage note: Replaces the MULTIPLY_BODY macro/raw-pointer loops with span-based forEachSlidingColumn/foldProduct plus RELEASE_ASSERTs (incl. a product-length wrap check) so the compiler hoists bounds checks; SaferCPP/perf refactor with no identified exploitable bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.

Structural signals: security_assert (+6.47), bounds_guard (+4.32), clamp_saturate (+1.8), area:Source/JavaScriptCore/runtime (+2.5), large_churn (-2.0)