Fix `String.prototype` polyfills

This takes care of all the issues reported in #562, except for `String.raw`.

Don’t merge this yet, I still have a few questions that I’ll leave as inline comments.