Fix BunProfile ObjectGroup/ILType consistency

Upstream added strict assertions that instanceType.properties and
instanceType.methods must exactly match the ObjectGroup's keys.

Two groups had drift:
- BunServer: ILType listed 'upgrade' method, ObjectGroup didn't define it
- Bun.Cookie: ILType listed 'expires' and 'maxAge', ObjectGroup omitted them

Both caused startup assertion failures post-upstream-sync.

Author: alii

Sources/Fuzzilli/Profiles/BunProfile.swift

@@ -841,6 +841,7 @@ public let bunServerGroup = ObjectGroup(
         "ref":       [] => .undefined,
         "unref":     [] => .undefined,
         "requestIP": [.jsAnything] => .jsAnything,
+        "upgrade":   [.jsAnything, .opt(.object())] => .boolean,
     ]
 )
 
@@ -864,9 +865,11 @@ public let bunCookieGroup = ObjectGroup(
         "value":    .string,
         "domain":   .string,
         "path":     .string,
+        "expires":  .jsAnything,
         "secure":   .boolean,
         "httpOnly": .boolean,
         "sameSite": .string,
+        "maxAge":   .integer,
     ],
     methods: [
         "toString": [] => .string,