潜在的原型链污染漏洞

复现代码1：
```javascript
let deepMix = require("@antv/util").deepMix;

let BAD_JSON = JSON.parse('{"__proto__":{"test":123}}');

let obj = {};
deepMix(obj, BAD_JSON);

console.log({}.test); // 123
```

问题代码：
https://github.com/antvis/util/blob/c499a30265ccf6099fc6e23d123f04b547eeaf5d/src/lodash/deep-mix.ts#L42-L47

复现代码2：
```javascript
let set = require("@antv/util").set;

let obj = {};
set(obj, "__proto__.test", 123);

console.log({}.test); // 123
```

问题代码：
https://github.com/antvis/util/blob/c499a30265ccf6099fc6e23d123f04b547eeaf5d/src/lodash/set.ts#L5-L29

Start by running the two JavaScript reproductions in the issue, then inspect src/lodash/deep-mix.ts lines 42-47 and src/lodash/set.ts lines 5-29. Verify both affected entry points no longer modify the shared object prototype through __proto__ input, and add regression coverage for the demonstrated cases.

Written by the indexing model from the issue text.