JS: Add New XSS sink - Next.js router.push/replace

[tyage]

Made Next.js router's push/replace methods as XSS sink.
They should be XSS sink because XSS occurs when their argument is javascript:alert(1).

https://nextjs.org/docs/api-reference/next/router#routerpush
https://nextjs.org/docs/api-reference/next/router#routerreplace

BTW, those methods are considered as XSS sink in the test code of ClientSideUrlRedirect but they are not actually treated as XSS sink.

codeql/javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/react.js

Lines 26 to 35 in 7f9b855

	export function nextRouter() {
	const router = useRouter();
	return <span onClick={() => router.push(document.location.hash.substr(1))}>Click to XSS 1</span>
	}
	import { withRouter } from 'next/router'
	function Page({ router }) {
	return <span onClick={() => router.push(document.location.hash.substr(1))}>Click to XSS 2</span>
	}