fix(just-extend): prevent prototype pollution via dangerous keys

[abhu85]

Summary

Fixes critical prototype pollution vulnerability (CVE pending) in just-extend@6.2.0.

The extend() function was vulnerable to prototype pollution attacks because it did not filter dangerous property names (__proto__, constructor, prototype) when iterating over source object keys. Attackers could pollute Object.prototype via:

const malicious = JSON.parse('{"__proto__":{"polluted":"yes"}}');
extend(true, {}, malicious);
// All objects now have {}.polluted === "yes"

Changes

• Block __proto__, constructor, and prototype keys in both index.cjs and index.mjs
• Replace weak existing prototype pollution test with comprehensive security tests:
  • __proto__ pollution blocked (deep & shallow)
  • constructor.prototype pollution blocked
  • Normal extend functionality preserved
  • Similar key names (e.g., proto, _constructor) still work

Test Results

All 1652 tests pass, including 4 new security-focused tests.

References

Fixes #593, Fixes #594

Before/After

Attack Vector	Before	After
{"__proto__":{"x":1}}	{}.x === 1	{}.x === undefined
{constructor:{prototype:{x:1}}}	Copied to result	Blocked