Update RegExpBuiltInExec to latest spec

[jugglinmike]

The ES2016 draft modifies the semantics of RegExpBuiltinExec to infer "global" and "sticky" using the regular expression object's [[OriginalFlags]] internal slot [1]. Update the algorithm accordingly.

This change removes two observable operations. An existing regression test relied on one of these operations (accessing the global property) during the evaluation of RegExp.prototype[@@replace]. Update the regression test to use a different mechanism to assert the same semantics.

[1] https://github.com/tc39/ecma262/pull/494

[jugglinmike]

This depends on gh-20.