Escape the database path in the SQLite connection string (closes #55)

openDB put the path into the connection string unescaped, so a ? or #
in it ended the file name and a % started an escape: scan could
silently fill a database under a shortened name. The path now goes
through net/url as a file: URI. An absolute path gets an empty host and
a relative path none, because SQLite reads what follows file:// up to
the next slash as a host name. The path is not cleaned, so it stays
exactly what the operator gave.

A test runs scan, report and trees against such a file name given as an
absolute path, as one starting with //, and as a relative path, and
checks that only that file and its lock file exist afterwards.

Model: opus-5-5

README.md

@@ -283,7 +283,9 @@ All three subcommands operate on a single SQLite database file:
 
 -   Location: the value of the `SFDUPES_DATABASE` environment variable
     when set and non-empty, otherwise `/var/lib/sfdupes/db.sqlite`.
-    There is no command-line flag.
+    There is no command-line flag. The path names the file exactly,
+    whatever characters it holds (`?`, `#` and `%` included); a
+    relative path is relative to the working directory.
 -   `scan` creates the database (and its parent directory) on first
     use. `report` and `trees` require an existing database; a missing
     database file is a fatal error (exit 1) telling the user to run