js-on-sx: fn.toString honours Function.prototype.toString overrides

Two hardcoded paths returned the native marker regardless of user
override: js-invoke-function-method and the lambda branch of
js-to-string. Both now look up Function.prototype.toString via
js-dict-get-walk and invoke it on the function, falling back to
the native marker only if no override exists.
built-ins/String: 84/99 → 85/99. conformance.sh: 148/148.

lib/js/test262-scoreboard.json

@@ -1,26 +1,26 @@
 {
   "totals": {
-    "pass": 84,
-    "fail": 12,
+    "pass": 85,
+    "fail": 11,
     "skip": 1,
     "timeout": 3,
     "total": 100,
     "runnable": 99,
-    "pass_rate": 84.8
+    "pass_rate": 85.9
   },
   "categories": [
     {
       "category": "built-ins/String",
       "total": 100,
-      "pass": 84,
-      "fail": 12,
+      "pass": 85,
+      "fail": 11,
       "skip": 1,
       "timeout": 3,
-      "pass_rate": 84.8,
+      "pass_rate": 85.9,
       "top_failures": [
         [
           "Test262Error (assertion failed)",
-          10
+          9
         ],
         [
           "Timeout",
@@ -40,7 +40,7 @@
   "top_failure_modes": [
     [
       "Test262Error (assertion failed)",
-      10
+      9
     ],
     [
       "Timeout",
@@ -56,6 +56,6 @@
     ]
   ],
   "pinned_commit": "d5e73fc8d2c663554fb72e2380a8c2bc1a318a33",
-  "elapsed_seconds": 192.4,
+  "elapsed_seconds": 182.4,
   "workers": 1
 }