fix(sbom): percent-encode vcs_url qualifier in generated purls

[ubeddulla]

Both SBOM generators build a git package's purl by sticking the raw node.resolved straight into the vcs_url qualifier, so any # or & in that resolved URL escapes the qualifier value. A git dep resolving to e.g. https://github.com/foo/bar.git?a=b&c=d#1234 produces pkg:npm/...?vcs_url=https://github.com/foo/bar.git?a=b&c=d#1234, where a purl parser reads c=d as a separate qualifier and 1234 as the subpath. Wrapping node.resolved in encodeURIComponent at both sites keeps it a single qualifier value; the existing git-url snapshots and two new assertions cover it.