URL: Stop normalizePath throwing on a malformed percent sequence

[konnen916]

What?

Closes #81085

normalizePath throws a URIError when a query parameter contains a malformed percent sequence. This switches it to the package's own safeDecodeURIComponent.

Why?

normalizePath decodes each parameter with bare decodeURIComponent, so a lone % in a value takes the whole call down:

normalizePath( '/wp/v2/posts?search=50%off' );
// URIError: URI malformed

This is the same failure that was fixed for getQueryArgs in #45561, where the throw was breaking Calypso. That PR introduced safeDecodeURIComponent for exactly this, and normalizePath was not updated at the time.

It reaches past the function because the preloading middleware in @wordpress/api-fetch calls normalizePath on every key of the preloaded data and on options.path for every request that passes through it. One unencoded %, in a hand-written path or in a server-generated preload key, takes out the middleware instead of failing a single request, and it surfaces during normalization rather than as an API error.

How?

One line plus the import, matching #45561: decodeURIComponent becomes safeDecodeURIComponent, which returns the component untouched when decoding fails.

Well-formed input is unaffected. Malformed input now normalizes instead of throwing, and the function stays order-stable, which is the property it exists to provide:

normalizePath( '/foo/bar?a=5&b=50%off' ) === normalizePath( '/foo/bar?b=50%off&a=5' );
// true

Testing Instructions

1. Open a post or page.
2. Open the console.
3. Run wp.url.normalizePath( '/wp/v2/posts?search=50%off' ).
4. On trunk it throws URIError: URI malformed. With this branch it returns /wp/v2/posts?search=50%25off.

Or run the package tests:

npm run test:unit -- packages/url

Two tests are added, one asserting it no longer throws and one asserting it stays order-stable when a parameter is malformed. packages/api-fetch also passes, since it is the consumer of this function.

Testing Instructions for Keyboard

Not applicable, this is a package-level change with no UI.

Screenshots or screencast

Not applicable.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @konnen916.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: konnen916.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

👋 Thanks for your first Pull Request and for helping build the future of Gutenberg and WordPress, @konnen916! In case you missed it, we'd love to have you join us in our Slack community.

If you want to learn more about WordPress development in general, check out the Core Handbook full of helpful information.