Import-time code execution via zod key injection

Code execution in Orval before 8.21.0 allows attackers to run JavaScript by importing a generated zod client from a crafted API specification. In packages/zod/src/index.ts, zod schema generation writes schema property names into double-quoted object keys without escaping embedded double quotes, so a malicious name can break out of the literal key and create a computed property expression that evaluates during module initialization. Exposure requires generation and import of a zod client from attacker-controlled OpenAPI v3 or Swagger v2 input, after which code runs in the developer workstation, CI job, test runner, or application process.