fix: preserve path taint through replace calls

[fusiontechstrategies]

Link to an issue, if relevant

Fixes #4044

Summary

• Remove blanket replace(...) sanitization from both path traversal rules
• Treat prefix-only traversal stripping as unsafe because a single replacement pass can expose another traversal sequence
• Add regression coverage for Express, JavaScript, and TypeScript while preserving explicit containment and named-sanitizer cases

Validation

• New regression cases fail before the rule change and pass afterward
• Targeted tests pass with Semgrep 1.176.0
• Targeted compatibility tests pass with Semgrep 1.170.0, the version from the issue report
• Rule configuration and metadata validation pass
• Repository pre-commit hooks pass in Linux
• Semgrep default ruleset reports zero findings in the rule definitions
• Detect-secrets and Gitleaks report zero findings