Fix JIT_CheckedWriteBarrier for MHR (dotnet/coreclr#26430)

Fix JIT_CheckedWriteBarrier for MHR (dotnet/coreclr#26430)

When Mojave hardened runtime support is enabled, the runtime places the
JIT_WriteBarrier copy into a dynamically allocated memory page. But
the JIT_CheckedWriteBarrier has a relative jump to the JIT_WriteBarrier
that I've missed when adding the MHR support and so we end up calling
the original unpatched code of the JIT_WriteBarrier from it.
This repros in release build only and causes problems only rarely,
so it was not detected until the corefx was updated to use the latest
coreclr. Even in the corefx tests, it caused problems when compiling
only one of the corefx tests.

This change fixes it in the same way as we handle jump to JIT_WriteBarrier
in the JIT_Stelem_Ref and its helpers - by using an indirect jump.
We do this for OSX only.

Commit migrated from https://github.com/dotnet/coreclr/commit/5b036452e3ed5d8b60435e3423e4fec245827ce1