Fix mergeWith prototype pollution

[Mo Jazayeri (mojaza)]

Summary

Fixes a prototype pollution vulnerability in Objects.mergeWith() when merging attacker-controlled objects, including values produced by JSON.parse().

Previously, a source property named __proto__ caused the merge to read the inherited Object.prototype value from the target and recursively merge into it. This could add attacker-controlled properties to every ordinary object in the process.

Details

• Only considers own properties on the target when deciding whether to recursively merge. Inherited values are treated as absent rather than mutated.
• Assigns __proto__ with Object.defineProperty() so it becomes an ordinary own data property instead of invoking the legacy prototype setter.
• Preserves the existing behavior for normal own properties, recursive object merges, customizers, arrays, primitives, and null values.
• Adds a patch change entry for @rushstack/node-core-library.

The change intentionally prevents merges from mutating objects reachable only through the target's prototype chain. This is the security boundary needed to prevent prototype pollution and should not affect normal merges of own properties.

How it was tested

• Added a regression test using JSON.parse('{"__proto__":{"polluted":true}}') and verified that Object.prototype remains unchanged while the target receives a safe own __proto__ property.
• Added coverage confirming inherited nested objects are not mutated and the source value is instead installed as an own target property.
• Ran rush test --to @rushstack/node-core-library successfully.