webcore: free Blob's owned content type on drop (#31358)

Blob kept its content type as a raw slice pointer plus an ownership
flag, with no drop glue. Consumers that drop a duplicated Blob by value
(the file read handler, `PathOrBlob`, `BlobOrStringOrBuffer`, `AnyBlob`,
the object-URL registry) relied on an explicit `deinit()` that several
of them never call, so the heap copy made by `dupe_with_content_type`
was stranded on every `Bun.file(p, { type }).text()` and similar paths.

This adds `impl Drop for Blob` that frees an owned content type, makes
`borrowed_view()` return a self-owning `dupe()` instead of aliasing the
source's allocation (which would double-free under the new Drop), and
hoists the deep copy in `dupe_with_content_type` ahead of construction.
The remaining `Blob { .., ..Default::default() }` literals are spelled
out since functional-record-update is rejected for Drop types.

Adds three tests to `test/js/web/fetch/blob.test.ts`: an RSS regression
test for repeated `.text()` on a file handle with a large custom type,
and two behavioral tests confirming the source handle's type survives
reads and `Bun.write`. Existing content-type ownership tests in that
file still pass.