[Profiler] Clean up CounterExpr allocation

Use a BumpPtrAllocator instead of a linked list,
and allocate internally within the CounterExpr so
we can just pass about values instead of pointers
and references. This allows us to eliminate
`CounterExpr::Ref`.

Unfortunately this means we can no longer store
CounterExprs in the SourceMappingRegions for
nodes, as we were previously using pointers to
propagate updates the counters made after the
region was popped. Instead we now have to query
the `CounterMap`. But IMO this is a worthwhile
tradeoff for code that's easier to reason about.

Author: hamishknight