fix(signup): validate check_type in duplicate duplicate_check endpoint

[KanhaiyaPandey]

Summary

Fixes a security issue in the duplicateUserCheck controller where
req.query.check_type was used without validation.

Previously, the value of check_type was used both as:

• A dynamic key to access req.query[checkType]
• The valueType option passed to User.findByEmailOrUsername

This allowed sending values such as:
check_type=__proto__ or check_type=constructor,
which could lead to prototype pollution or unexpected behavior.

Changes

• Added strict validation to allow only:
  • 'email'
  • 'username'
• Return 400 Bad Request for any invalid check_type
• Removed unsafe dynamic usage without whitelist validation

Why This Is Needed

User input should never be used as dynamic object keys
without validation. This change ensures:

• Safer query handling
• Prevention of prototype manipulation
• Predictable endpoint behavior

Testing

• Verified valid requests:
  • /duplicate_check?check_type=email&email=test@example.com
  • /duplicate_check?check_type=username&username=testuser
• Verified invalid requests:
  • /duplicate_check?check_type=__proto__
  • /duplicate_check?check_type=constructor
• Confirmed invalid inputs return 400.

This improves input validation and overall endpoint security.

closes #3906

[welcome]

🎉 Thanks for opening this pull request! Please check out our contributing guidelines if you haven't already.