Accept a source path or query holding %25 in an image URL

The path traversal check now reads only the host and source path, not
the source query, and keeps a "%" that does not start a percent-escape
as it is, decoding the escapes around it, instead of refusing the URL.
Stopping the decoding at that "%" would let a double-encoded ".."
elsewhere in the path through.

Model: opus-5-5

TODO.md

@@ -42,8 +42,8 @@ P2: security: per-origin rate limiting
   writes Go's own encoding of the path. The README has an example with a query
   and its signature. The path traversal check no longer reads the source query,
   and keeps a `%` that does not start a percent-escape as it is instead of
-  refusing the URL, so a source path or query holding `%25` is accepted, while
-  a double-encoded `..` next to such a `%` is still refused.
+  refusing the URL, so a source path or query holding `%25` is accepted, while a
+  double-encoded `..` next to such a `%` is still refused.
 - 2026-10-15 `max_concurrent_processing` defaults to half the CPUs pixa sees,
   rounded down, and at least 1 (closes #242): it defaulted to one image per CPU,
   and a container with no CPU limit sees every CPU of the host, so on a 48-CPU