Make taming membrane distrust Object.prototype.toString.

The taming membrane uses Object.prototype.toString to detect builtin
objects (Date, Float32Array, etc.) and copy them across the membrane
as the same type. ES6 allows objects to change their "toStringTag",
thus making this spoofable.

Therefore, harden each special copy case so that if the toString result
is spoofed, the membrane cannot be punctured.

Also fixed some ineffective tests in test-taming-inout-guest.js.

@r5710

[MarkM, 2015-02-18 23:20:53]

Do you intend to fix cajaTamingGoogleLoader in a separate CL? Or did you
conclude it is fine as is?

https://codereview.appspot.com/202140043/diff/1/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/test-taming-inout-guest.js (right):

https://codereview.appspot.com/202140043/diff/1/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/test-taming-inout-guest.js:103: }());
huh. embarrassing.

[kpreid_google, 2015-02-18 23:36:26]

On 2015/02/18 23:20:53, MarkM wrote:
> Do you intend to fix cajaTamingGoogleLoader in a separate CL? Or did you
> conclude it is fine as is?

It's fine as-is because it's interacting with Google API code, which we assume
is innocent.

[MarkM, 2015-02-18 23:37:45]

LGTM