[6.x] fix: do not let setProperty change the prototype (#1899)

[jportner]

Resolves #1909.

This PR backports #1899 to the 6.x branch.

Hopefully this security change can be released as a 6.11.4 version, as many packages rely on protobufjs 6.x and cannot be easily upgraded.

[jportner]

@bcoe you reviewed the original PR linked above, would you be able to review this one too?

[mizevkon]

@bcoe , @alexander-fenster folks, would be awesome if you have a look.

[egasimus]

This seems to have been released to NPM, but there doesn't seem to be a corresponding release tag on GitHub for people to audit the source code?

[mizevkon]

Backport was made and published as 6.11.4, though there is no official announcement:
https://github.com/protobufjs/protobuf.js/commits/release-6.11.4

[alexander-fenster]

Sorry, I backported the fix separately without seeing this PR :) Thank you everyone for chiming in here.

I have no idea how to make "official announcement" but the advisory is now updated.

[egasimus]

@alexander-fenster

how to make "official announcement"

Please at least add 6.11.4 tag to the commit where the fix landed, and from which the package was published to NPM 🙏