fix(opentelemetry-core): add extra checks on internal merge function for safety

[maryliag]

The mergeTwoObjects function iterates over keys from untrusted objects without filtering proto, constructor, or prototype, which would allow someone controlling a config object to pollute Object.prototype.

Fix: Add a key check before processing

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.74%. Comparing base (36ce569) to head (fc92b57).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
packages/opentelemetry-core/src/utils/merge.ts	80.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6587      +/-   ##
==========================================
- Coverage   95.75%   95.74%   -0.02%     
==========================================
  Files         375      375              
  Lines       12725    12735      +10     
  Branches     3013     3021       +8     
==========================================
+ Hits        12185    12193       +8     
- Misses        540      542       +2     

Files with missing lines	Coverage Δ
packages/opentelemetry-core/src/utils/merge.ts	97.05% <80.00%> (-1.86%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[trentm]

Looks good, thanks.

(I'd also welcome a separate PR to remove this export from the "core" package -- a breaking change that would need to be part of the coming SDK 3.0 -- and update the only place that currently uses this:

opentelemetry-js/packages/opentelemetry-sdk-trace-base/src/BasicTracerProvider.ts

Line 7 in 8ee2a8b

import { merge } from '@opentelemetry/core';

;)

[trentm]

(I'd also welcome a separate PR to remove this export

I opened #6597 for this.