fix: potential prototype-polluting assignment

[ddevsr]

Potential fix for https://github.com/PHPDevsr/js-validation/security/code-scanning/1

The safest minimal fix (without changing external functionality) is to harden the dictionary-like containers and reject dangerous keys:

1. Store methods, locales, and per-language locale maps as prototype-less objects using Object.create(null), so special keys do not resolve through Object.prototype.
2. Validate incoming keys (lang and method name) and reject __proto__, constructor, and prototype.
3. When merging locale messages, iterate keys and copy only safe own properties (also rejecting dangerous message keys) instead of blindly Object.assign into a potentially sensitive object.

In src/core.js, update:

• static field initializers for methods and locales
• addLocaleMessages(...) to validate lang, initialize safe map, and copy safe keys
• addMethod(...) to validate name before assignment

No new imports or dependencies are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.