[M-6] UrlValidator::safeRedirectPath doesn't URL-encode fragment

Resolved.

UrlValidator::safeRedirectPath now sanitises path/query/fragment before reassembly (src/Services/UrlValidator.php):

• All three parts strip bytes 0x00–0x1F and 0x7F (control characters that some clients treat as header terminators).
• Fragment is additionally rawurlencode()d before being appended after #.

All 7 UrlValidator tests still pass. A crafted Referer with control chars or #javascript: bytes can no longer slip through into a Location: header.

Locking this thread.