fix(assertString): reject objects with constructor/name property spoofing

[MD-Mushfiqur123]

Fixes #2692

assertString was vulnerable to spoofing via objects with a custom constructor property:

assertString({ constructor: { name: "String" } }); // should throw but did not

This fix uses typeof and Object.prototype.toString.call() instead of relying on input.constructor.name, which can be easily spoofed.

Changes:

• Use typeof + Object.prototype.toString.call() for reliable string detection
• Use optional chaining for safe constructor name access in error messages
• Add tests for spoofed objects, boxed strings, and null-prototype objects

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (7fdc788) to head (9182762).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2722   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2587      2589    +2     
  Branches       656       657    +1     
=========================================
+ Hits          2587      2589    +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.