Fixes V8 bailouts for `propertiesFromHTMLOptions` function

Before:

![bailouts](https://cloud.githubusercontent.com/assets/1131196/4175916/51e9079c-35ec-11e4-9de0-a83abb8c2c22.png)

After:

![bailouts-fix](https://cloud.githubusercontent.com/assets/1131196/4175920/6b51211a-35ec-11e4-9423-271910496a9c.png)

Bailout reason: "ForIn is not fast case"

It turns out that we can use `Object.keys` instead of using `for-in`.

`for-in` is actually more expensive as it will enumerate properties in
the prototype chain as well (you have to use `hasOwnProperty` check
which is not cheap). More about
[`for-in`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for...in)
for the curious.

`Object.keys` will return an array of a given object's own enumerable
properties. That is very handy because we can avoid `hasOwnProperty`
check and looking up properties on the prototype chain.

```javascript
var a = { bar: 'foo', baz: 'blah' };
Object.keys(a);
// ["bar", "baz"]
Object.getOwnPropertyDescriptor(a, 'bar');
// Object {value: "foo", writable: true, enumerable: true, configurable: true}
```