Spike: Investigate ways to isolate annotation layer code from page JS

An issue that has been seen on a number of websites are modifications to the JS environment breaking the code for the annotation layer in the client. Examples include:

[Broken Function.prototype.bind polyfill](https://github.com/hypothesis/h/issues/2644)
[Array.prototype augmentations](https://github.com/hypothesis/product-backlog/issues/143)
[Window.hasOwnProperty override](https://github.com/hypothesis/client/issues/195)

All of these issues could be mitigated by finding a way to isolate the code in the annotation layer from the code in the page. Some available strategies include:

1. Running all of the client's code as a _content script_ in the extension. This is the standard way to avoid this problem in browser extensions. (potential to help 40% of users)
2. Running the bulk of the code for the annotation layer in a same-document iframe. This should create a fresh JS/DOM environment for the code, although it won't protect against modifications to the DOM of the page where the annotations are to be drawn. (potential to help 100% of users)
3. Taking advantage of future platform APIs to isolate scripts from the rest of the page - eg. the [Realm API](https://github.com/tc39/proposal-realms) (not viable yet)

The outcome of the spike should be a write-up of the currently available options to implement isolation, along with a working proof of concept for each, details of any caveats and estimates of how long it would take to complete the implementation.

Start by reviewing the three isolation strategies and the linked examples of broken page JavaScript. Compare currently available options, then produce a write-up, a working proof of concept for each viable approach, caveats, and implementation time estimates.

Written by the indexing model from the issue text.