fix(scan): percent-encode dork queries before search

[TBX3D]

the google-search client only swaps spaces for '+' and drops the term
into the query string verbatim, so a dork carrying a raw '#' or '&' cut
the request url short at the fragment or split it into stray query
params. the search then ran against a fragment of the intended dork.
encode the term up front so the whole dork survives.

[github-actions]

pr summary

2 files changed (+95 -5)

category	files
go source	2
tests	1

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 40.00000% with 3 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@7ea1cd2). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
internal/scan/dork.go	40.00%	3 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #327   +/-   ##
=======================================
  Coverage        ?   54.74%           
=======================================
  Files           ?       81           
  Lines           ?     6876           
  Branches        ?        0           
=======================================
  Hits            ?     3764           
  Misses          ?     2843           
  Partials        ?      269           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vmfunc]

checked the actual client, buildUrl in rocketlaunchr/google-search just does Trim then space->'+' and drops the term straight into ?q=, zero encoding. so yeah, a raw '#' landed in the fragment and '&' split the params, exactly as you describe. QueryEscape is the right call here: space still ends up as '+' so the client's own replace is a no-op, and '#'/'&'/'+' round-trip clean on google's side. nice that buildSearchURL in the test actually mirrors buildUrl instead of asserting against itself, the truncation guard is real. in.