Escape : and % in the signed and cached path and query (closes #247)

The signed data and the cache key joined host, path and query with ":"
and no escaping, so path /a:b with no query and path /a with query b:
gave the same string: a URL signed for one verified for the other, and
whichever was fetched first was served for both. Both now write each "%"
in the path and query as "%25" and each ":" as "%3A" before joining them.
A path and query holding neither are signed and keyed as before.
"Signature Specification" in README.md states the escaping.

Model: opus-5-5

TODO.md

@@ -30,6 +30,14 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a `:` in the source path or query no longer moves where the path
+  ends and the query begins (closes #247): the signed data and the cache key
+  joined host, path and query with `:` and no escaping, so a URL signed for
+  `https://h/a:b` verified for `https://h/a?b:`; the two also shared a cache
+  key, and whichever was fetched first was served for both. In both, the path
+  and the query now have each `%` written as `%25` and each `:` as `%3A`; a path
+  and query holding neither are signed and keyed as before. Signature
+  Specification in `README.md` says so.
 - 2026-10-15 the example config allowlists no host (closes #249): it allowlisted
   `github.com` and `user-images.githubusercontent.com`, where anyone can put an
   image, so a deployment set up as Getting Started says served those images to