[v26.x backport] vm: fix property queries for proxy sandboxes

[brianathere]

Backport of #63742 to v26.x-staging.

Fixes: #63739
Refs: #63549

This updates the vm contextify named property query path to inspect own property descriptors on the sandbox object instead of using HasRealNamedProperty() for that sandbox lookup. The previous lookup cannot see properties through a JSProxy, which made Proxy-backed vm sandboxes report false for hasOwnProperty, Object.hasOwn, in, and Reflect.has even when the property was readable, listed, and had an own descriptor.

The fallback lookup on the real global proxy remains unchanged for properties that are not own properties of the sandbox.

Added a regression test for a Proxy sandbox with writable, non-enumerable, and readonly own properties, plus prototype fallback sanity checks.

Validation on v26.x/v26.x-staging branch:

• ninja -C out/Release -j12 node
• ./out/Release/node test/parallel/test-vm-proxy-sandbox-property-query.js
• python3 tools/test.py -J --mode=release parallel/test-vm-proxy-sandbox-property-query parallel/test-vm-property-definer-interception parallel/test-vm-global-property-interceptors
• git diff --check HEAD~1..HEAD
• External minimal repro: stock v26.3.0 fails, patched branch passes
• External Jest fake-timers repro: patched branch passes both tests

[legendecas]

Backports must wait until the original change lands on the main branch.