ECHO-8FFE-C246-E62C Fix backtracking protection. Adjusts pos/backtrack tracking inside the path replacer so backslash and dot matches don't reset the backtrack buffer prematurely, preventing ReDoS via crafted inputs. Backported from https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4 (shipped upstream as 0.1.12). The index.js hunk is upstream verbatim; the test.js hunk reuses upstream's test but is repositioned to land inside v0.1.10's `describe('path-to-regexp', ...)` block (upstream's diff context expected an intervening non-security commit not present in 0.1.10).