False positive for Prototype-polluting function

I check for prototype polluting property keys in a set of reserved keys which include `__proto__` and `constructor`.

This shouldn't even be necessary since the key, value come from Object.entries which according to MDN will only iterate own enumerable string-keyd property. ie. never `__proto__` or `constructor`.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/entries


Still the lookup in the set does not work.

```js
// Iterate through the source own enumerable string-keyed property key-value pairs.
for (const [key, value] of Object.entries(source)) {

// This for codeql only. key, value of Object.entries should ensure that only own properties are parsed
if (!source.hasOwnProperty(key)) continue;

// The ignoreKeys contain checks against prototype pollution.
if (new Set(['__proto__', 'constructor', 'mapview']).has(key)) {

continue;
}
```

CodeQL looks at the right place but ignores the check for the set.

https://github.com/GEOLYTIX/xyz/security/code-scanning/217


The only way I can make the issue go away is by doing a === check on the string value like so.

```js
// Prevent prototype polluting assignment.
if (key === '__proto__' || key === 'constructor') return true;
```

Even though I know that this issue can not happen I need to add this extra line to make the CodeQL warning go away.

Inizia dall’avviso di scansione del codice CodeQL collegato e dallo snippet JavaScript segnalato; non viene indicato alcun file del repository né alcun test. Traccia il modo in cui la query pertinente gestisce Object.entries e l’appartenenza a Set, quindi aggiungi o aggiorna la copertura di regressione in modo che questo falso positivo non venga più segnalato.

Scritto dal modello di indicizzazione a partire dal testo della issue.