Decode SCP URI components and remove IPv6 address brackets

[OskarEichler]

Summary

Decode percent escapes in SCP URI user/password/path components once, preserve literal plus signs, and pass an unbracketed IPv6 hostname to the SSH layer.

Reproduction and evidence

With a captured download! call, scp://a%2Bb:p%40ss@[::1]:2222/a%20b previously forwarded [::1], a%2Bb and /a%20b. It now forwards ::1, a+b and /a b, with the password decoded to p@ss. Twenty-four focused assertions cover DNS/IPv6 hosts, escaped spaces, literal plus signs, double-escaped percent text and UTF-8 paths. Combined local scp-backed URI.open integration transfers a file whose name contains a space.

Compatibility / breaking changes

URI components now receive normal URI decoding. A literal percent escape in an actual remote name must be encoded as %25 in the URI. No form-style plus-to-space decoding is used. Correct forwarding of URI port/password into :ssh is a separate PR; this patch only corrects component representation.

Verification and limits

• This focused branch passes the existing upstream suite: 36 tests / 70 assertions, Ruby 4.0.6, net-ssh 7.3.3, test-unit 3.7.8 and Mocha 2.1.0; all Ruby commands used rbenv.
• The combined release-based consumer candidate passes the suite with frozen string literals enabled, 10 focused cases, 2,906 model assertions, 24 URI-component assertions and 19 local scp/URI assertions. Combined evidence includes other separately proposed fixes and existing upstream frozen-string corrections; it is not attributed to this patch alone.
• No repository tests added/modified under the consuming project's explicit no-new-tests policy. Reproductions/models ran externally. No deployed servers, SSH connections or production data were used.
• All seven runtime files parse with the Ruby 2.6 parser; actual older-Ruby/Windows/remote-server matrices were not run locally. No upstream lint config exists; targeted lint has the same eight pre-existing warnings, with no new warnings.
• Existing upstream PRs/issues and contribution guidance were checked. Maintainer CI results are pending; no CI pass is claimed.