Add malloc_create_partition and {m,re}alloc_from_partition to mozmemory's API.
Copy sandbox option strings instead of adopting them.

Strings coming from JS objects are allocated on a separate heap,
but nsCString is unaware of that, and tries to free its underlying
buffer using a regular free(); because of that, we need to copy the
string into a separate buffer allocated from the correct heap.
Use a separate partition for all SpiderMonkey allocations.
Add MOZ_JEMALLOC3 to mozconfig.
Bug 1078451 - Accept a free function in ThreadSharedFloatArrayBufferList::SetData r=jesup