Prototype Pollution via oj.extend

## Security Vulnerability: Prototype Pollution in oj.extend

### Description
The `oj.extend` function is vulnerable to **Prototype Pollution**. This allows an attacker to inject properties into the global `Object.prototype` by passing a crafted object containing the `__proto__` key. When the prototype is polluted, it can lead to unintended behavior across the entire application and potentially allow for further exploitation.

### Proof of Concept (PoC)
```javascript
const oj = require('oj');

// Crafting the malicious object
const maliciousObject = JSON.parse('{"__proto__": {"polluted": "Yes, contaminated!"}}');

// Triggering the pollution via extend
oj.extend({}, maliciousObject);

// Checking the global prototype
console.log({}.polluted); // Output: "Yes, contaminated!"

Impact
​An attacker can contaminate the global object, leading to Information Disclosure or Denial of Service (DoS). In some environments, this can be escalated to Remote Code Execution (RCE).
​Recommended Fix
​Validate keys during the merge/extend process to block sensitive keys such as __proto__, constructor, and prototype.

Start by locating the implementation of oj.extend and trace how keys from the source object are merged into the target. Reproduce the provided JSON.parse proof of concept first, then verify that sensitive keys such as __proto__, constructor, and prototype no longer pollute Object.prototype.

Written by the indexing model from the issue text.