fix(benchmarks): split the allocation-site key explicitly instead of with replace

CodeQL flagged `key.replace("|", ...)` as js/incomplete-sanitization (high): it
replaces only the first occurrence. Here that was intentional - the key is
`functionName|url:line` and only the first separator matters - but written as a
replace it reads as a broken sanitiser, and it would mangle any URL containing a
pipe. Splitting on indexOf says what it means. Path trimming now uses replaceAll,
which is what was meant there too.

scripts/benchmarks/analyze-allocations.mjs

@@ -48,8 +48,19 @@ const ownerOf = (key) => {
   return "other";
 };
 
-const shorten = (key) =>
-  key.replace("|", "  <- ").replace("/app/apps/nextjs/.next/server/", "").replace("/app/node_modules/", "");
+/**
+ * Renders a `functionName|url:line` key for display. Split on the first separator explicitly
+ * rather than with a single-occurrence `replace`, which reads as a botched sanitiser (CodeQL
+ * flags it as one) and would mangle any URL that itself contained a pipe.
+ */
+const shorten = (key) => {
+  const separator = key.indexOf("|");
+  const functionName = separator === -1 ? key : key.slice(0, separator);
+  const url = separator === -1 ? "" : key.slice(separator + 1);
+  return `${functionName}  <- ${url}`
+    .replaceAll("/app/apps/nextjs/.next/server/", "")
+    .replaceAll("/app/node_modules/", "");
+};
 
 let label;
 let total;