fix: add interception route check

[zhongliang02]

Context

In a recent VAPT on care360, it was discovered that an open redirect is still possible by using an undocumented feature (interception routes interpolation) (issue labelled as GTA-55-008).

Approach

In this version bump, I have ported the check for interception routes into the validation logic.
This should block the the undocumented feature.
In the next version bump, a strict character whitelist will be enforced by default, with an option to override it.

Risk

This will break existing routes that contain (.) or (..) or (...) or (..)(..).

Testing

The fix can be verified simply by visiting the links below and checking if the open redirect can still be triggered.

Email: any@open.gov.sg
OTP: 123123

[v1.2.10 open redirect poc] [deploy src]
[v1.2.11 poc no longer works] [deploy src]

VAPT vendor says [link]

most likely resolves the issue. At least for the most recent Next.js versions. There might be older versions where the fix doesn't work.