Define error semantics on serialising JS return values

As @domenic pointed out to me in #whatwg, we have failed to define error behaviour related to the Execute Script and Execute Async Script commands. For any JS object an injected script interacts with, there is a chance of failure.

This is especially problematic for the internal JSON clone algorithm that serialises return values from injected scripts. If we for example consider the following injected script:

let rv = new Array(3);
Object.defineProperty(Array.prototype, "1", { get () { throw new Error("foo"); } })
return rv;

Here there is no chance of avoiding hitting the error when the array’s items are serialised in turn. The failure case above needs to be defined in detail.

(Depending on the implementation of the driver, script injection overriding document prototypes may also effect other commands that in theory are meant to work on the underlying data structures indepedently of prototype overrides, but I think this is outside the scope of this issue.)

This issue is related to the one @jugglinmike filed about fixing collection serialisation following my change.

Start by reading the internal JSON clone algorithm and the Execute Script and Execute Async Script command definitions in the WebDriver specification. Compare the serialization failure example with related issue #1347 and pull request #1340; done means the specification defines the error behavior for failures while serialising injected-script return values.