Fix Array.prototype.slice() of large arrays in the non-fast keys path

Fix Array.prototype.slice() of large arrays in the non-fast keys path

When the slice result length was 32761 or more, the destination array was
non-fast and slice_copy() reached the keys path, which enumerated every
own index of the source and copied each at its original key, ignoring the
requested [start, start + length) window and the destination-relative
position.  Array.prototype.slice() thus returned wrong results for such
arrays.

Filter the enumerated keys to the window and write them at index - start,
matching the fast-array path.

While here, also remove dead fast object path in slice_copy.