Harden gRPC package loading against prototype pollution

Scope

Port Bun corpus position 3987, js/third_party/grpc-js/test-prototype-pollution.test.ts.

Required contracts

• never traverse or assign __proto__, prototype, or constructor package path segments
• preserve Object.prototype when hostile package definitions are loaded
• still materialize ordinary dotted package definitions instead of ignoring all arbitrary input
• use own-property definitions so inherited setters cannot intercept package construction

Verification

• focused upstream file passes both pollution cases
• permanent diagnostics prove hostile paths are discarded and safe paths remain loadable
• existing gRPC, SQL adapter, and third-party gates remain green

Implemented and pushed in c0dd7ecdc.

Completed contracts:

• rejects __proto__, prototype, and constructor package path segments at every depth
• hostile package definitions cannot modify Object.prototype
• ordinary dotted package definitions are still materialized
• namespace creation uses own-property definitions, avoiding inherited setters
• known proto-loader fixture definitions retain their generated gRPC service constructors

Verification:

• focused Bun corpus: 2 passed, 0 failed, 0 todo, 0 unsupported
• permanent gRPC diagnostics: 14 passed
• SQL adapter contracts: passed
• permanent third-party JWT/utility mini-suite: passed
• zig fmt --check and git diff --check: passed

Cumulative through position 3987: 329 files, 2,743 passed, 209 todo, 0 failed, 0 unsupported, 171 allowed-empty.