Convert any name starting with __ to start with ___ instead.

This effectively makes the space of identifiers starting with __ (but not ___)
available for the compiler to use internally, without worrying about collisions.
It also works as a satisfactory way of ensuring that an identifier with the name
__proto__ (which will be converted to ___proto__) won't cause any problems when
stored in an object.