Fix: prevent OOB panic in decodeURI by tightening percent-decoding bounds; add test for incomplete escape %E7%9A%8 (#4404)

[hamflx]

This Pull Request fixes/closes #4404.

It changes the following:

• Tightens percent-decoding boundary check in core/engine/src/builtins/uri/mod.rs::decode to prevent out-of-bounds access (uses >= per spec).
• Adds unit test decode_uri_reports_uri_error_on_incomplete_sequence to assert decodeURI('%E7%9A%8') raises JsNativeErrorKind::Uri.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 50.27%. Comparing base (6ddc2b4) to head (a0ddc64).
⚠️ Report is 513 commits behind head on main.

Files with missing lines	Patch %	Lines
core/engine/src/builtins/uri/mod.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4405      +/-   ##
==========================================
+ Coverage   47.24%   50.27%   +3.03%     
==========================================
  Files         476      508      +32     
  Lines       46892    51127    +4235     
==========================================
+ Hits        22154    25706    +3552     
- Misses      24738    25421     +683     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nekevss]

Nice catch! Thanks for the quick fix on this! 😄