@orpc/zod: Prototype injection in smart coercion

## Summary `ZodSmartCoercionPlugin` and `experimental_ZodSmartCoercionPlugin` mishandle object keys that name `Object.prototype` members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of the coerced input object, and 2. make a request fail with an unhandled `TypeError` by sending a key such as `constructor`. This is the same class of bug as GHSA-4h5r-cv8j-4456 in `@orpc/json-schema`, in a different package. ## This is not global prototype pollution **The global `Object.prototype` is never modified.** No shared or global state is written, so other objects in the process, other requests, and other users are not affected. What changes is the prototype of one object: the value the coercer returns for the request that carried the payload. That object is passed on to validation and to the procedure handler, then discarded when the request ends. An ordinary `{}` created anywhere else in the application is unaffected. ## Details ### 1. `__proto__` replaces the prototype of the coerced value Coerced properties were collected into a plain `{}`, so `newObj['__proto__'] = value` triggers the inherited `__proto__` setter instead of creating an own property. Verified on 1.14.8 against a record schema, in both plugins: ``` schema: z.record(z.string()) input: {"a":"1","__proto__":{"polluted":true}} Object.keys(result) => ["a"] // the __proto__ entry is dropped from the outp