bridge: add setMarshallingProperties; a lightweight alternative to setMarshallingDescriptor

For an object it just whitelists properties, and for Error / Function objects it
allows whitelisted properties to be sent (by default properties on these
objects are ignored).
seed: limit uploaded app size (10mb for now)
seed: use @bridge.setMarshallingProperties to improve @auth.isAuthenticationError