Encode dynamic URL paths and query parameters

[sosnovsky]

In some places, we build URL strings with raw interpolated values, including Attester public key lookup paths and query strings. Dynamic path segments should use encodeURIComponent, and query strings should use URLSearchParams or Url.create to prevent encoded traversal or parameter injection from changing the intended request target.