rewrite: escape file matcher paths before rewriting

[cyphercodes]

Summary

• Preserve matched file paths containing literal ? and % when try_files rewrites to {http.matchers.file.relative}.
• Keep file-matcher path placeholders escaped while rewrite parses the target URI, so matched paths are not mistaken for query delimiters or decoded twice.

Fixes #7678

Tests

• go test ./modules/caddyhttp/fileserver -run TestTryFilesRewriteEscapesMatchedPath -count=1
• go test ./modules/caddyhttp/rewrite ./modules/caddyhttp/fileserver -count=1

Assistance Disclosure

AI assistance was used for investigation, implementation, and tests. I used Hermes Agent (OpenAI GPT-5.5) and verified the generated changes with the tests above.

[CLAassistant]

All committers have signed the CLA.

[cyphercodes]

Pushed a follow-up to cover the multiple-depth case: the try_files rewrite test now includes an escaped filename under a nested path and creates parent directories for table cases.

Local verification:

• go test ./modules/caddyhttp/fileserver -run TestTryFilesRewriteEscapesMatchedPath -count=1 ✅
• go test ./modules/caddyhttp/rewrite ./modules/caddyhttp/fileserver -count=1 ✅
• git diff --check ✅

[francislavoie]

I meant a test that covers a request with %2F in the filename not conflicting with nesting.

Also you need to sign the CLA, your commits authored by AI will probably need to be rewritten.

[cyphercodes]

Pushed a follow-up for the %2F case: the try_files rewrite test now covers a literal nested%2Ffile.html filename while a real nested nested/file.html also exists, so the encoded slash path is verified not to conflict with directory nesting.

Local verification:

• go test ./modules/caddyhttp/fileserver -run TestTryFilesRewriteEscapesMatchedPath -count=1 ✅
• go test ./modules/caddyhttp/rewrite ./modules/caddyhttp/fileserver -count=1 ✅
• git diff --check ✅

[francislavoie]

We can't accept the changes without the CLA being signed.

[steadytao]

@cyphercodes You must clean and rebase this branch as your AI Agent Hermes Agent pushed a commit with empty identity fields, then review and sign our CLA yourself.

[cyphercodes]

Rewrote the branch metadata so all three commits are authored/committed as cyphercodes <cyphercodes@users.noreply.github.com>.

No source changes were made in this rewrite; it only replaces the previous Hermes Agent <hermes@example.invalid> commit identity so the CLA check can associate the commits with my GitHub account.

[francislavoie]

I think fmt.Sprint is being used because val is type any, but that's not the right way to do it. The type should be asserted to be string explicitly, not just fed into fmt.Sprint.

[cyphercodes]

Pushed a follow-up for the latest review: {http.matchers.file.relative} is now only escaped after asserting the replacer value is a string, instead of formatting the any value with fmt.Sprint.

Local verification:

• go test ./modules/caddyhttp/fileserver -run TestTryFilesRewriteEscapesMatchedPath -count=1 ✅
• go test ./modules/caddyhttp/rewrite ./modules/caddyhttp/fileserver -count=1 ✅
• git diff --check ✅