add support for replace in Next.js router

Author: erik-krogh

javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll

@@ -182,6 +182,8 @@ module ClientSideUrlRedirect {
    * A call to change the current url with a Next.js router.
    */
   class NextRoutePushUrlSink extends ScriptUrlSink {
-    NextRoutePushUrlSink() { this = NextJS::nextRouter().getAMemberCall("push").getArgument(0) }
+    NextRoutePushUrlSink() {
+      this = NextJS::nextRouter().getAMemberCall(["push", "replace"]).getArgument(0)
+    }
   }
 }