fix: sanitize config for __ keys

According to upstream, this is supposed to be fore prototype pollution
prevention.

See: https://github.com/mermaid-js/mermaid/blob/9745f325cb9e1967640f0e85da193a2f820634f1/packages/mermaid/src/config.ts#L169-L174

src/lib/util/state.ts

@@ -180,6 +180,11 @@ function getUnsafePaths(object: object, unsafeKeys: string[], path: string[] = [
   Object.keys(object).forEach((key) => {
     const value = object[key] as unknown;
     const currentPath = [...path, key];
+    // Prototype pollution check.
+    if (key.startsWith('__')) {
+      unsafePaths.push(currentPath);
+      return;
+    }
     if (typeof value === 'object' && value !== null) {
       unsafePaths.push(...getUnsafePaths(value as object, unsafeKeys, currentPath));
     }