Restrict dunder path access on objects

[gaoflow]

Summary

• restore object path restrictions from a two-key denylist to any dunder key
• add __class__ coverage for get/invoke and a set_ regression test for class attribute pollution
• keep dict/list path access behavior unchanged for matching string keys

Tests

• PYTHONPATH=src python -m pytest tests/test_objects.py -k "restricted or test_set__raises" --no-cov
• PYTHONPATH=src python -m pytest tests/test_*.py -o addopts=""
• python -m ruff check src/pydash/helpers.py
• git diff --check

Notes

• PYTHONPATH=src python -m pytest --no-cov is not the primary local verification because the default pytest config collects tasks.py without the optional dev dependency invoke, and collects mypy-testing files without enabling their plugin mode.

Closes #240

[coveralls]

coverage: 100.0%. remained the same — gaoflow:fix-restricted-dunder-keys-240 into dgilland:develop

[dgilland]

Thanks for the contribution, much appreciated! 👍