CVE-2023-26136: tough-cookie Prototype Pollution vulnerability

The vulnerability stems from using object literals ({}) instead of Object.create(null) for the cookie store index (idx). When operating in rejectPublicSuffixes=false mode, attackers could set cookies with proto in domain/path fields, polluting the Object prototype. The commit 12d4747 explicitly replaces all {} initializations in memstore.js with Object.create(null) to prevent prototype inheritance, confirming these functions' involvement. The added test case in cookie_jar_test.js demonstrates the exploit scenario targeting these object initialization patterns.