Detect URL-encoded CRLF (%0D%0A) in FtpWebRequest URI

[Copilot]

FtpWebRequest already rejects URIs containing a literal \r\n with a clear FormatException, but the URL-encoded form %0D%0A slips past the check and fails later with a less informative exception — a common case when a stray CRLF from upstream parsing gets URL-encoded for safety.

Changes

• src/libraries/System.Net.Requests/src/System/Net/FtpWebRequest.cs: Extend the constructor's CRLF check to also match %0D%0A case-insensitively, throwing the same FormatException (net_ftp_no_newlines) up front.
• src/libraries/System.Net.Requests/tests/FtpWebRequestTest.cs: Add Ctor_NewLineInUri_ThrowsFormatException theory covering literal \r\n and the %0D%0A / %0d%0a / %0D%0a casing variants.

if (uri.OriginalString.Contains("\r\n", StringComparison.Ordinal) ||
    uri.OriginalString.Contains("%0D%0A", StringComparison.OrdinalIgnoreCase))
    throw new FormatException(SR.net_ftp_no_newlines);

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.