@antv/scale Prototype Pollution Vulnerability

hi, we are a security team. We found a Prototype Pollution vulnerability in your project.
### Vulnerability Title
Prototype Pollution Vulnerability in the deep merge function of @antv/scale npm package
### Vulnerability Type
Prototype Pollution
### Root Cause
The built-in merge deep merge function of the package does not perform security validation on input key names, allowing the __proto__ keyword to be directly written to the object prototype chain, resulting in malicious tampering of the global Object.prototype.
### Precise Code Location
Package Name: @antv/scale
File Path: lib/util.js
Line Number: Lines 128–135 (Recursive assignment logic for deep merge)
### POC Verification Code
```javascript
const scale = require('@antv/scale');
const payload = { "__proto__": { antvPolluted: true } };

scale.util.merge({}, payload);
console.log({}.antvPolluted); // Output: true, vulnerability verified successfully
```

Start by reading lib/util.js at lines 128–135, where the recursive deep-merge assignment occurs. Run the provided proof-of-concept against @antv/scale to reproduce the behavior. Done means the merge no longer allows the __proto__ payload to make antvPolluted appear on a new object.

Written by the indexing model from the issue text.