Fix disallowed-character stripping when replacement is an empty string

[SimYunSup]

When replacement is an empty string, disallowed characters are no longer stripped, so the output can contain characters outside the documented allowed set.

The per-character loop has a branch that preserves the replacement string when a character contains it:

} else if (char.includes(opts.replacement)) {

''.includes('') is always true, so with an empty replacement every character takes this branch and the disallowedChars filter in the final else never runs. The result:

slug('a<b>c')       // 'abc'
slug('a<b>c', '')   // 'a<b>c'   (before this change)

This is inconsistent: the default replacement strips < and >, but an empty replacement lets them through, even though both modes promise output within [A-Za-z0-9] (pretty) / [\w\-.~] (rfc3986).

The fix skips that branch when the replacement is empty, so an empty replacement falls through to the filter:

} else if (opts.replacement !== '' && char.includes(opts.replacement)) {

After the change, slug('a<b>c', '') returns 'abc', while slug('foo bar baz', '') still returns 'foobarbaz'. Added a test covering the empty-replacement case in both pretty and rfc3986 modes.

[Trott]

Thanks for the fix. 🚀