The CVE-2021-23450 guard rejects __proto__ and constructor but not prototype, so setObject("Object.prototype.x", v) still pollutes Object.prototype through any named global constructor. Reject prototype alongside the other two.

The CVE-2021-23450 guard (extended in dojo#458 to reject `prototype`) checks
the segments that getProp walks, but setObject pops the final segment and
assigns it directly with `obj[p] = value`, bypassing that guard. So
setObject("__proto__", value) and setObject("x.__proto__", value) still
reassign a prototype.

Apply the same __proto__/constructor/prototype denylist to the popped
final segment before assigning, completing the guard from dojo#458. Adds
regression tests alongside the existing CVE-2021-23450 cases.

dojo#460 guards the hash form of Stateful.set, where the for...in loop skips
the key. The two argument form has no such guard: set("__proto__", value)
falls through to the scalar branch and runs this[name] = value, which
replaces the prototype of the instance instead of setting an attribute on
it. Afterwards the instance is no longer an instanceof its class, get and
set are gone, and a value carrying a function replaces a method rather
than data. Application code reaches the two argument form whenever it
copies a parsed object one key at a time.

The same direct write is in _changeAttrValue, in lang._mixin (so
lang.mixin, lang.clone and lang.extend) and in declare.safeMixin (so
declare(null, props) and Class.extend(props) as well). Skip the key in
those four places, the way the hash branch and request/util.deepCopy
already do.

The sibling loops guarded by has("bug-for-in-skips-shadowed") are left
alone: they iterate lang._extraNames, a fixed list of seven
Object.prototype members, so __proto__ cannot appear there. declare mixOwn
is left alone as well, since it copies from a class prototype and those
members arrive through safeMixin. store/Memory has the same write in its
constructor, but a __proto__ key there makes the following setData call
throw, which is a loud failure and better handled on its own.

Object.prototype is not involved. Each case replaces the prototype of the
target object only.