Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization

The `dedotdotify()` function in `lib/urlapi.c` is responsible for removing path traversal sequences (`../` and `./`) from URLs according to RFC 3986. However, the function only recognizes literal forward slashes (`/`) when identifying path segments and does not handle URL-encoded slashes (`%2f` or …

   { "%2f%2e%2e%2f", "%2f%2e%2e%2f" }