fix(security): prevent prototype pollution in DOM helpers

[ghiscoding]

Summary

• Reject unsafe property names in DOM property dictionaries.
• Prevent option merges from replacing object prototypes.
• Restrict locale resolution to own registry properties.
• Use a prototype-free virtual-scroll cache.
• Replace unsafe direct hasOwnProperty usage.
• Add focused prototype-pollution regression tests.

The vulnerability was reproduced against the published
multiple-select-vanilla@5.2.1 package.

Verification

• 8 security regression tests passed.
• 92 Playwright tests passed.
• TypeScript build passed.
• Biome lint and formatting passed.
• pnpm audit --prod found no known vulnerabilities.
• Bundle impact: +337 bytes minified and +139 bytes gzip.

LLM assistance

Audit and implementation assisted by OpenAI GPT-5.6 Sol.

[github-actions]

Playwright E2E Test Results

92 tests  ±0   92 ✅ ±0   1m 59s ⏱️ -8s
75 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit c528b1d. ± Comparison against base commit 615499f.

♻️ This comment has been updated with latest results.

[github-actions]

🎉 This pull request is included in version 5.2.2 📦
🔗 The release notes are available at: GitHub Release 🚀