Remove attack-prone IsPromise special-casing.

As illustrated in the new test, by overriding the `then` method of a Promise object, an attacker could cause an `onFulfilled` passed to a real promise that has been resolved to the overridden promise to be invoked arbitrarily. This occurred because we used an IsPromise check to special-case and call the `then` method directly, instead of coercing the result. This kind of optimization does not belong in the spec, even if we did make it foolproof. It should just be removed.