Make __proto__ a foreign callback on Object.prototype.

Make __proto__ a foreign callback on Object.prototype.

This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.

The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.

R=rossberg@chromium.org
BUG=v8:621, v8:1949, v8:2441
TEST=mjsunit,cctest,test262

Committed: http://code.google.com/p/v8/source/detail?r=13728

[rossberg, 2013-02-05 12:15:12]

lgtm

[Michael Starzinger, 2013-02-26 10:46:11]

Committed patchset #3 manually as r13728 (presubmit successful).