faster es53: cajaVM.def edition

This change reduces startup time of a minimal gadget
from ~1800ms to ~1100ms in Chrome Beta (16.0)

This change is mostly about speeding up cajaVM.def(), mainly
by changing a recursive implementation to an iterative one.

cajaVM.def also ends up invoking
  Object.prototype.ownKeys___
  whitelistAll
and this change speeds those up by using Object.keys when
possible, and inlining some tests.

[metaweta, 2011-12-15 16:58:48]

LGTM

http://codereview.appspot.com/5493043/diff/2001/src/com/google/caja/plugin/do...
File src/com/google/caja/plugin/domado.js (right):

http://codereview.appspot.com/5493043/diff/2001/src/com/google/caja/plugin/do...
src/com/google/caja/plugin/domado.js:330: //cajaVM.def(method);  // unnecessary
in theory.  TODO(felix8a): verify
If method isn't frozen, then something like this is possible:

method.toString = function() { this.x=1; return "blah"; };
method.toString(); // as called on line 336
assertEquals(method.x, 1);

I don't think this attack is particularly dangerous, since whoever is calling
this is probably in a position to modify method anyway.

[felix8a, 2011-12-15 17:47:32]

@r4689