appview: path-escape all refs passed between appview & knotserver

appview/state/pull.go

···
 		return
 	}
 
-	hiddenRef := url.QueryEscape(fmt.Sprintf("hidden/%s/%s", sourceBranch, targetBranch))
+	hiddenRef := fmt.Sprintf("hidden/%s/%s", sourceBranch, targetBranch)
 	// We're now comparing the sourceBranch (on the fork) against the hiddenRef which is tracking
 	// the targetBranch on the target repository. This code is a bit confusing, but here's an example:
 	// hiddenRef: hidden/feature-1/main (on repo-fork)

appview/state/signer.go

···
 		Method = "GET"
 	)
 
-	endpoint := fmt.Sprintf("/%s/%s/branches/%s", ownerDid, repoName, branch)
+	endpoint := fmt.Sprintf("/%s/%s/branches/%s", ownerDid, repoName, url.PathEscape(branch))
 
 	req, err := us.newRequest(Method, endpoint, nil)
 	if err != nil {

knotserver/routes.go

···
 func (h *Handle) Branch(w http.ResponseWriter, r *http.Request) {
 	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	branchName := chi.URLParam(r, "branch")
+	branchName, _ = url.PathUnescape(branchName)
+
 	l := h.l.With("handler", "Branch")
 
 	gr, err := git.PlainOpen(path)
···
 	l := h.l.With("handler", "NewHiddenRef")
 
 	forkRef := chi.URLParam(r, "forkRef")
+	forkRef, _ = url.PathUnescape(forkRef)
+
 	remoteRef := chi.URLParam(r, "remoteRef")
+	remoteRef, _ = url.PathUnescape(remoteRef)
+
 	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	gr, err := git.PlainOpen(path)
 	if err != nil {