[chrmod]

Follow-up to #69, targeting its branch.

#69 calls the handler's own setPrototypeOf trap after the cycle check. This makes that call behave like a native Proxy in two more cases:

• A null trap is ignored. Before, { setPrototypeOf: null } threw a TypeError.
• A trap added later works. Before, the trap was read only once, when the proxy was created.

The cycle check still runs first. The trap must still be the handler's own property, so page code cannot add one through Object.prototype.

Not covered

• Inside any trap, this is an internal object that inherits from the handler, not the handler itself. Traps can share state through this, but this === handler is false and writes to this do not show up on the handler. This has been the case since Reject cyclic prototypes on scriptlet proxies #67.
• A trap inherited by the handler (e.g. from a class) is still ignored, as in Preserve handler setPrototypeOf traps on scriptlet proxies #69.
• A handler's trap can still create a cycle by setting a different prototype than the one it was given. Handlers are scriptlet code, so this is left alone.