Only dynamically perform access checks on the receiver if it's a JSGlobalProxy. Proxies up the chain are guaranteed to provide access if we had access to the receiver, since otherwise we wouldn't have been able to compile the stub in the first place. If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=

Review URL: https://codereview.chromium.org/958843002

Cr-Commit-Position: refs/heads/master@{#26875}