Parser: report an invalid "for-in" target as a SyntaxError

Parser: report an invalid "for-in" target as a SyntaxError

Previously, an invalid for-in target was a ReferenceError when the
initializer happened to parse as a LeftHandSideExpression and a SyntaxError
otherwise, so the same target changed class once parenthesized:

    for (a = 1 in {});     SyntaxError
    for ((a = 1) in {});   ReferenceError

The fix is to report a SyntaxError for both, as the specification and V8 do.
The type is observable through Function(), so this is a compatibility change.
njs keeps ReferenceError for invalid assignment targets elsewhere.