The dotted-key parser in `normalizeEnvToObject` walked into
`Object.prototype` when a key path started with `__proto__`,
`constructor`, or `prototype`, and `setBuiltinEnvArg` used `in`
(which traverses the prototype chain) to detect an existing
reserved RSPACK_* flag — so an attacker controlling `--env`
could pollute every plain object in the process and spoof
reserved build-mode flags.

Mitigations applied to packages/rspack-cli/src/utils/options.ts:

- Reject any `--env` whose dotted path contains
  `__proto__` / `constructor` / `prototype` (aligned with lodash
  `_.set` hardening for CVE-2020-8203).
- Build the root and every intermediate node with
  `Object.create(null)` so lookups can never reach
  `Object.prototype`.
- Replace `(envName in env)` with `Object.hasOwn(env, envName)`
  in `setBuiltinEnvArg` so a polluted prototype cannot mask a
  legitimate write.

Regression coverage: packages/rspack-cli/tests/utils/options.test.ts
asserts the three payload shapes (`__proto__.X=Y`,
`constructor.prototype.X=Y`, and reserved-flag spoofing) plus
the existing nested-key happy path.

Address PR #14165 review feedback:

- Codex (P2): the env object is handed to the user's rspack config
  function `(env) => ({...})`, so changing it to a null-prototype
  object breaks benign callsites that do `env.hasOwnProperty(...)`
  or `env instanceof Object`. The dangerous-key denylist already
  fences off pollution at the parser entrance, so the root and
  intermediate nodes can stay as plain `{}` without losing the
  security property.

- Copilot: `Object.hasOwn` requires ES2022 but the repo targets
  ES2021. Switch to `Object.prototype.hasOwnProperty.call`, which
  has the same no-prototype-lookup guarantee.

Add a regression test asserting `env instanceof Object` and
`env.hasOwnProperty(...)` continue to work for benign inputs.