fix($parse): disallow passing Function to Array.sort

Fix the following exploit:

    hasOwnProperty.constructor.prototype.valueOf = valueOf.call;
    ["a", "alert(1)"].sort(hasOwnProperty.constructor);

The exploit:
• 1. Array.sort takes a comparison function and passes it 2 parameters to compare.
  2. It then calls .valueOf() if the result is not a primitive.
• The Function object conveniently accepts two string arguments so we can use this
  to construct a function.  However, this doesn't do much unless we can execute it.
• We set the valueOf function on Function.prototype to Function.prototype.call.
  This causes the function that we constructed to be executed when sort calls
  .valueOf() on the result of the comparison.

The fix is in two parts.
• Disallow passing unsafe objects to function calls as parameters.
• Do not traverse the Function object when setting a path.
revert: "fix($compile): render nested transclusion at the root of a template"

This reverts commit 6d1e7cdc51c074139639e870b66997fb0df4523f.

This commit was causing breakages because of its assumption that transcluded
content would be handled predictably, i.e. with ngTransclude, whereas many
use cases involve manipulating transcluded content in linking functions.
docs(ngModel): update breaking change from 1.3.0-beta.11 to 1.3.0-beta.12

Closes #8357
test($parse): adding benchmark for execution of $parse()ed expressions

Part of #8901
perf($parse): remove getterFn wrapper for internal use

Closes #8901
docs: add perf todo notes from #8515
refactor(ngModel): remove $$invalidModelValue and refactor methods

- define `ngModelGet` and `ngModelSet` to already use
  the getter/setter semantics, so the rest of the code does
  not need to care about it.
- remove `ctrl.$$invalidModelValue` to simplify the internal logic
fix(ngModel): render immediately also with async validators
fix(ngModel): update model value with async validators correctly

If the view value changed in the first digest and there are async validators,
the view value was never applied to the model after the validators were
resolved. Only important for tests.
feat(ngModelOptions): add allowInvalid option

This option allows to write invalid values to the model instead of having them become undefined.
Use this together with calling `ctrl.$setValidity` directly for displaying errors
from serverside validation.

Closes #8290
Closes #8313
docs(CHANGELOG.md): add changes for 1.3.0-rc.1 and 1.2.24
docs(CHANGELOG.md): fix wording and remove reverted change
docs(CHANGELOG.md): add upcoming breaking change
docs(api/index): fix strange uses of the word namespace
docs(angular.testability): add jsdoc marker to ensure it is included in docs
docs(angular.getTestability): unpublish the function as it is not public
fix(ngModel): don’t clear the model when an external validator failed

Calling `ctrl.$setValidity()` with a an error key that
does not belong to a validator in `ctrl.$validator` should
not result in setting the model to `undefined` on the next
input change. This bug was introduced in 1.3.0-beta.12.

Closes #8357
Fixes #8080
perf($compile): move $$isolateBinding creation to directive factory instead of on each link
docs(ngResource): document steps to skip default json serialization/deserialization
docs(tutorial): update step 7 to reference angular-phonecat

This changes the example JSON to be the actual bower.json for angular-phonecat,
with name set to angular-phonecat.