Modify whitelist/blacklist to check values, not names

[lawnsea]

@DavidBruant pointed out in an email exchange that white/blacklisting by
property names may miss aliases of privileged properties. Instead, he suggested
that I do something like he does here.

The core idea is to specify white/blacklist properties names, save the values,
and then walk the global object graph, checking everything against the values.
It may be convenient to do some form of globbing as well: Array.**.*, for
example.