fix(sbom): percent-encode vcs_url qualifier in generated purls (#9670)

Both SBOM generators build a git package's purl by sticking the raw
`node.resolved` straight into the `vcs_url` qualifier, so any `#` or `&`
in that resolved URL escapes the qualifier value. A git dep resolving to
e.g. `https://github.com/foo/bar.git?a=b&c=d#1234` produces
`pkg:npm/...?vcs_url=https://github.com/foo/bar.git?a=b&c=d#1234`, where
a purl parser reads `c=d` as a separate qualifier and `1234` as the
subpath. Wrapping `node.resolved` in `encodeURIComponent` at both sites
keeps it a single qualifier value; the existing git-url snapshots and
two new assertions cover it.