Bug fixes

Important changes

• Security: prevent prototype pollution. mergeObj now ignores the
  __proto__ and constructor keys, uses own enumerable properties only, and
  creates plain objects when merging nested data. This prevents untrusted
  payloads from modifying object prototypes.
• Security: validate Drafty URLs. Drafty now rejects unsafe URL schemes
  such as javascript:, data:, and vbscript:. URL validation is applied to
  links, buttons, media references, and download URLs; relative URLs and
  http, https, and ftp URLs remain supported.
• Harden links opened in a new window. Drafty links that use
  target="_blank" now also include rel="noopener noreferrer".

Other changes

• Added regression tests for prototype-pollution protection and Drafty URL
  sanitization.
• Added coverage for AccessMode construction, permission updates, and
  preservation during nested object merges.
• Updated dependencies and rebuilt the development and production UMD
  bundles for the 0.25.4 release.

Full comparison: v0.25.3...v0.25.4