fix: prevent prototype pollution via __proto__ in FormData field names

[milamer]

Summary

parseFormData walked bracket- and dot-notation field names into nested
objects without filtering reserved property keys. A single FormData field
whose name began with __proto__, or contained .__proto__. mid-path,
caused the parser to traverse and assign onto Object.prototype,
polluting the prototype chain of every plain object in the running
process.

import { parseFormData } from 'parse-nested-form-data';
const fd = new FormData();
fd.append('__proto__.polluted', 'yes');
parseFormData(fd);
console.log(({}).polluted); // -> 'yes'  ← before this PR

Fix

handlePathPart now throws a new ForbiddenKeyError (also exported)
when any path segment is __proto__, constructor, or prototype.
The check runs before object/array type branching, so it covers both
a.__proto__.x and any future code path that might route a forbidden
key through the array branch.

The array branch was not exploitable in practice today - the regex
restricts array-index segments to digit characters - but applying the
check uniformly removes the dependence on that invariant. Three new
tests assert that a[__proto__], a[constructor], and a[prototype]
throw and never pollute, so any future regex change that loosens the
input shape will surface the gap loudly rather than silently.

Tests

• 6 new prototype-pollution tests in src/__tests__/index.ts
• All 52 tests pass
• 100% coverage maintained

Release impact

Conventional fix: commit → semantic-release will cut 1.0.1
(patch). Previously-accepted inputs with __proto__ / constructor /
prototype segments now throw ForbiddenKeyError - no legitimate use
of these as form field names is expected to be affected.

Disclosure

Reported responsibly by Mohamed Bassia
(@0xBassia) via private email. A GitHub
Security Advisory with CVE assignment will be published after 1.0.1
lands on npm so that downstream users are notified through Dependabot
and npm audit.

This PR also adds SECURITY.md documenting the disclosure channel for
future reports.

[github-actions]

🎉 This PR is included in version 1.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀