fix: reject __proto__/constructor/prototype filter keys (prototype pollution)

[BrianWillows]

Summary

The filter reducer assigns into an object using the query-string parameter
name as the key, with no guard on prototype-walking names:

.reduce((result, { prefix, key, op, value }) => {
  if (!result[key]) { result[key] = {}; }
  ...
  } else { result[key][op] = value; }   // key === '__proto__' -> Object.prototype[op] = value

When key is __proto__, result['__proto__'] resolves through the getter to
Object.prototype, so the assignment writes an attacker-controlled, enumerable
property onto the prototype of every object in the process (CWE-1321 prototype
pollution).

Reproduced on 6.1.0:

aqp('__proto__>5');
({}).$gt        // => 5

The library's intended input is exactly an untrusted query string
(aqp(req.query) in an Express/Mongo API), so this is reachable directly from a
request. No configuration is needed — blacklist defaults to empty and
whitelist is undefined.

The polluted keys are limited to Mongo operators ($gt, $gte, $lt, $lte,
$ne, $nin), so this is not an arbitrary-gadget pollution, but the value is
fully attacker-controlled and the property is enumerable — every for (k in obj)
in the process then yields it, which corrupts query shapes and object iteration
generally.

Fix

Reject the three prototype-walking key names in the same filter that already
applies blacklist/whitelist. They are not usable Mongo field names, so no
legitimate query is affected.

const FORBIDDEN_KEYS = ['__proto__', 'constructor', 'prototype'];
...
!FORBIDDEN_KEYS.includes(key) &&
!options.blacklist.includes(key) && ...

Verification

• Existing test suite passes unchanged (ava, 65 tests passed).
• aqp('__proto__>5') now returns {"filter":{}} and ({}).$gt stays
  undefined; the constructor, prototype and !=a,b/$nin variants are
  blocked too.
• Normal queries are unchanged, e.g.
  aqp('status=sent&price>100&sort=-date&limit=5') still yields
  {"sort":{"date":-1},"limit":5,"filter":{"status":"sent","price":{"$gt":100}}}.

Notes

Found and fixed with AI assistance (Claude). Happy to add a regression test to
the suite if you'd like one.