record<> converted to a JS value should use a null prototype

[domenic]

Currently records get converted to a JS value with %Object.prototype% as their [[Prototype]].

We should instead consider using a null prototype. This avoids false positives where it appears that properties like toString, valueOf, etc. are members of the record.

This also matches some Ecma-262 precedent a bit better: RegExp's exec() method returns a null-prototype "record" for its groups property (step 24.a). Indeed, the case that is prompting this issue is the desire to add a similar groups property for service worker scope pattern matching.

With regard to compatibility: most records in specs are used in input position (e.g. as parameters, or as parts of dictionaries that are themselves used as parameters). The following are the ones I found in output position:

• A couple in webrtc-stats: 1, 2
• As the result of toJSON() for PushSubscription

I'm unsure whether this change is good for those cases. Traditionally, objects returned by toJSON() do not have null-prototype. Hmm.