[security] Remove Underscore dependency affected by CVE-2026-27601

[kai5263499]

Security finding

The default branch permits Underscore >= 1.3.3, which includes versions affected by CVE-2026-27601 / GHSA-qpx9-hpmf-5gmw (high severity). This is a vulnerable dependency-range finding, not a demonstrated exploit in this wrapper.

Advisory: GHSA-qpx9-hpmf-5gmw
Existing alert: https://github.com/kai5263499/mandrill-node/security/dependabot/1

Changes

• Remove Underscore from the runtime dependencies entirely.
• Replace its few uses with native ES5 array concatenation, Object.keys, and membership checks. The constant API-option lists have no overlapping entries, so concatenation preserves their existing contents and order.
• Keep util locally scoped while removing the Underscore import.
• Add dependency-free offline regression tests and expose them through npm test. Existing live-API tests are retained unchanged.

Validation performed

• Verified the starting package.json and mandrill.js bytes against their GitHub blob SHAs before editing.
• node --check mandrill.js — passed.
• node --check unit/offline-tests.js — passed.
• npm test on Node 22.16.0 — passed: all 28 API calls, exact allowed-option lists, request URL/body, rejection of invalid options without a request, key caching, malformed JSON handling, and absence of the Underscore import.
• Requests are stubbed; no external API calls or real API keys were used.

Review notes / limits

The declared Node engine range is unchanged; the historical Node 0.6 runtime was not available for testing. No live Mandrill integration test or full dependency audit was run. The existing request dependency is outside this specific fix and remains unchanged. This PR does not certify the repository as free of other vulnerabilities.

No merge or alert dismissal is requested automatically.