LibJS: Support receiver in ProxyObject::get/put()

If a receiver is given, e.g. via Reflect.get/set(), forward it to the
target object's get()/put() or use it as last argument of the trap
function. The default value is the Proxy object itself.

Libraries/LibJS/Tests/builtins/Proxy/Proxy.handler-set.js

@@ -43,6 +43,21 @@ describe("[[Set]] trap normal behavior", () => {
         p[Symbol.hasInstance] = "foo"
         expect(p[Symbol.hasInstance]).toBe("foo");
     });
+
+    test("custom receiver value", () => {
+        const o = {};
+        const r = {};
+        let p = new Proxy(o, {
+            set(target, property, value, receiver) {
+                receiver[property] = value;
+                return true;
+            },
+        });
+
+        expect(Reflect.set(p, "foo", 42, r)).toBe(true);
+        expect(o.foo).toBeUndefined();
+        expect(r.foo).toBe(42);
+    });
 });
 
 describe("[[Set]] invariants", () => {