The WebkitMessagingTransport previously only captured handler references at
construction time on legacy WebKit (macOS Catalina, < 11). On modern WebKit
it instead re-read window.webkit.messageHandlers[handler] freshly on every
send.

That meant the transport silently broke if site-level privacy hardening
replaced or removed window.webkit.messageHandlers after init. Concretely,
the apiManipulation feature can be used to install a prototype-side
getter that nullifies messageHandlers for site JS (to reduce
window.webkit fingerprinting surface on external sites). Without this
change, any page-world C-S-S feature that calls notify/request/subscribe
after the nullify would synchronously throw inside wkSend reading
undefined[handler] — and silently degrade because the surrounding
polyfills (e.g. webCompat Notification) catch the throw and return
defaults.

After this change:
- captureWebkitHandlers runs unconditionally in the constructor on both
  legacy and modern WebKit.
- On legacy, the original postMessage is still deleted from the host
  handler (preserving the existing security posture for macOS < 11).
- On modern, the original postMessage is left in place so any other code
  reading through window.webkit.messageHandlers continues to see the
  host binding's normal shape.
- wkSend uses the captured reference on both paths.

Adds unit tests in injected/unit-test/messaging-webkit.spec.js covering:
- modern capture + routing through captured ref
- modern leaves original postMessage in place
- modern transport survives wholesale replacement of
  window.webkit.messageHandlers
- modern throws MissingHandler when a handler was never registered
- legacy still deletes original postMessage
- legacy still adds the secure messaging envelope (secret)

- Use Object.create(null) for capturedWebkitHandlers so a hostile page
  cannot supply a callable via Object.prototype pollution if a capture
  miss ever occurs. Add a unit-test that pollutes Object.prototype with
  a callable for an unregistered handler name, then asserts wkSend still
  throws MissingHandler rather than invoking the polluted function with
  outgoing native payload (per Bugbot review feedback).
- Slim the captureWebkitHandlers docstring to drop the legacy/modern
  split (per Jonathan's review feedback) while preserving the contract.

Adds @ts-expect-error comments on the test-only ad-hoc Object.prototype
mutation and its cleanup, since the property is intentionally not part
of the Object type.

The eslint-disable-next-line was shifted out of position by inserting
the @ts-expect-error comment between it and the offending assignment,
so the linter was suppressing the wrong line. Reorder so eslint-disable
sits directly above the Object.prototype mutation.

Per Bugbot review feedback on PR #2729: even with Object.create(null) as
the cache, the construction goes through globalThis.Object.create — which
page JS can replace before transport construction runs, because Messaging
is lazy on ContentFeature.messaging. Same concern applies to
Function.prototype.bind used at capture time.

- Switch capturedWebkitHandlers initializer from Object.create(null) to
  the { __proto__: null } literal, which is a syntactic construct rather
  than a method dispatch and so cannot be tampered with by page JS.
- Stop calling .bind() at capture time. Store the handler object and the
  raw postMessage function as a { handler, postMessage } pair, and
  dispatch in wkSend via the captured ReflectApply (already imported
  from captured-globals.js, which captures Reflect.apply.bind(Reflect)
  at module-load time before any page JS can run).

Adds two regression tests:
- 'cache is not derived from a tampered Object.create' replaces
  Object.create with a tampered factory before the transport is
  constructed and asserts that the cache still rejects an unknown
  handler name with MissingHandler (rather than resolving a property
  injected by the tampered factory).
- 'stores handler and postMessage as a separate pair' structurally
  asserts the capture stores raw references rather than a bound
  function, proving Function.prototype.bind is not on the capture or
  send path. (Direct Function.prototype.bind tampering in a Jasmine
  test breaks Jasmine itself because its spy machinery uses bind, so
  the structural assertion is the safe equivalent.)
- 'dispatches through the captured handler with the correct `this`'
  asserts the send path preserves host-binding semantics via
  ReflectApply rather than a bare unbound call.