Add WeakRef, FinalizationGroup to start compartment only

[erights]

They are now standard, reality, and needed by the Agoric platform. They are powerful and should be added to the start compartment only, and only to the initialGlobalPropertyNames whitelist.

WeakRef.prototype.constructor should be an InertWeakRef constructor, or at least a powerless one, so that WeakRef instances do not grant the ability to observe more than can be observed with that one instance.

There's probably a similar need for an InertFinalizationGroup but more thought is needed.

[erights]

See See Agoric/agoric-sdk#1931

[kriskowal]

Please reöpen if this issue persists, but under the current regime, lockdown() does not delete these globals from the realm / start compartment. They are omitted from the default global of child compartments.

[erights]

They are simply omitted from the shared intrinsics. Arguably, they should be treated more like Function or Date, with a shared prototype pointing at an inert constructor. Low priority, but worth revisiting, so reopening.