Process-wide object pollution via unsafe note merge

Prototype pollution in ExcelJS 4.4.0 and earlier allows remote attackers to alter Object.prototype through user-controlled cell notes. Note.prototype.get model passes non-string note objects to _.deepMerge, which recursively assigns proto, constructor, and prototype keys without filtering them. Reachability requires an embedding application to place parsed attacker-controlled JSON in cell.note and serialize the workbook; successful pollution changes inherited properties for later plain objects in the same process.