### Describe the bug

Axios is vulnerable to Regular Expression Denial of Service (ReDoS). When a manipulated string is provided as input to the format method, the regular expression exhibits a time complexity of O(n^2). Server becomes unable to provide normal service due to the excessive cost and time wasted in processing vulnerable regular expressions.

Please visit https://huntr.com/bounties/69a1aa07-c36e-4d9e-9325-b634e0aa4bb0/

### To Reproduce

_No response_

### Code snippet

```js
const axios = require('axios');

console.time('t1');
axios.defaults.baseURL = '/'.repeat(10000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t1');

console.time('t2');
axios.defaults.baseURL = '/'.repeat(100000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t2');


/* stdout
t1: 60.826ms
t2: 5.826s
*/
```


### Expected behavior

A regex optimization

### Axios Version

1.6.2

### Adapter Version

XHR/HTTP

### Browser

Chrome

### Browser Version

_No response_

### Node.js Version

20.10.0

### OS

Linux

### Additional Library Versions

_No response_

### Additional context/Screenshots

_No response_
lib/helpers/combineURLs.js
'use strict';
/**
 * Creates a new URL by combining the specified URLs
 *
 * @param {string} baseURL The base URL
 * @param {string} relativeURL The relative URL
 *
 * @returns {string} The combined URL
 */
export default function combineURLs(baseURL, relativeURL) {
  return relativeURL
    ? baseURL.replace(/\/+$/, '') + '/' + relativeURL.replace(/^\/+/, '')
    : baseURL;
}