[Bugfix beta] slightly defensive perf

Ember.merge is global and as such if merge(x, y) ever happens where y is not safe for enumeration, it can deopt the function (in v8) for all other users.

Since functions are shared, deopting merge can cause inlining bailout cascades throughout the framework. Now it is still possible to deopt it by for example passing a global like window to it, but at least it wont happen more unexpectedly.
Merge pull request #5645 from stefanpenner/def-perf

[Bugfix beta] slightly defensive perf