[codex] Escape FakeRequest URLs and curl commands

[k-kinzal]

Summary

• URL-encode FakeRequest path parameter values as path segments so spaces, slashes, and apostrophes do not corrupt the generated URL.
• Keep query parameters encoded through Guzzle's query builder while preserving raw values in toPsr7() query params.
• Shell-quote generated curl URL, header, and body arguments so single quotes in user data produce valid commands.

Validation

• composer test
• composer lint