Escape the database path in the SQLite connection string (closes #55)

openDB put the path into the connection string unescaped, so a ? or #
in it ended the file name and a % started an escape: scan could
silently fill a database under a shortened name. The path now goes
through net/url as a file: URI. An absolute path gets an empty host and
a relative path none, because SQLite reads what follows file:// up to
the next slash as a host name. The path is not cleaned, so it stays
exactly what the operator gave.

A test runs scan, report and trees against such a file name given as an
absolute path, as one starting with //, and as a relative path, and
checks that only that file and its lock file exist afterwards.

Model: opus-5-5

TODO.md

@@ -29,6 +29,9 @@
 
 # Completed Steps
 
+- a database path holding `?`, `#` or `%` opens exactly the file it names
+  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/55)
+
 - `scan` rejects `--workers` below 1 as a usage error instead of
   running single-threaded (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/10)