Low-cost revocation via altered GC semantics

[dead-claudia]

Partial duplicate of #10 but goes a bit further.

So here's the idea:

• Symbols get an implicit [[Revoked]] boolean property. In practice, this could be modeled via a bit flag or an internal weak set. (It still must be concurrency-safe, so a bit flag is likely ideal.)
• In the spec, a proxy is considered "revoked" if it has a revocation symbol with a [[Revoked]] property set to true.
• In engines, while scanning proxies, if a proxy has a revocation symbol with that field set, the handler now becomes safely collectable. The act of setting that property is sufficient to trigger a possible GC check, much like an object going out of scope.

Doing it this way also has a benefit: there's no need for a dedicated factory for such symbols. You can just create them normally via Symbol.