escape version/digest in artifact registry data source request paths

[naruto-lgtm]

Repro: set image_name = "img@sha256:abc/../../otherRepo/dockerImages/x" on google_artifact_registry_docker_image, or a package_name/artifact_id whose version segment contains /, ?, or #, on the npm/python/maven data sources. The name half of the resource path is URL-escaped but the version/digest half is not, so the ../ walks out of the dockerImages/<name> segment and the GET resolves to a different resource than the one configured.

Cause: the by-version/by-digest lookup is built as .../npmPackages/%s:%s (and .../dockerImages/%s@%s) with only the name passed through url.QueryEscape while the version/digest is interpolated raw. These identifiers can arrive from a module input, tfvars, or remote data, so the raw segment lets a caller-supplied value add path segments, a query string, or a fragment to the request URL.

Fix: route the trailing {name}{sep}{version} component through one helper that keeps the name's query-escaping and path-escapes the version/digest. A valid semver or sha256:<hex> digest is unchanged; /, ?, and # are percent-encoded.

artifactregistry: fixed request path construction in the `google_artifact_registry_docker_image`, `google_artifact_registry_npm_package`, `google_artifact_registry_python_package`, and `google_artifact_registry_maven_artifact` data sources so a `version`/`digest` segment containing URL metacharacters no longer alters the request path

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@ScottSuarez, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.