Use Object.create(null) as `merge` target, to prevent prototype pollution (#7917)

Use Object.create(null) as merge target to prevent polluting `Object.prototype`