fix(passwordless): encode session IDs in send URLs

[gjtorikian]

Description

• Encode the session ID with rawurlencode() before building the sendSession URL, matching generated services and the HTTP client's documented caller contract.
• Add request-level regression coverage for slashes, slash-containing traversal strings, query/fragment delimiters, literal percent escapes, spaces, and plus signs.
• Preserve ordinary session IDs, the POST method, and the empty JSON-object body without changing shared HTTP-client encoding.

Addresses VULN-1251.

Validation

• php vendor/bin/phpunit tests/PasswordlessTest.php: 4 tests, 44 assertions.
• composer ci: formatting and PHPStan pass; 352 tests, 1,713 assertions, 3 skipped.
• git diff --check: passes.

Scope

Exact . and .. session IDs remain unchanged by rawurlencode(), so server-dependent dot-segment normalization still applies to those two literal values. Shared HTTP-client defense-in-depth is outside this local fix. Tests use mocked requests; no live-infrastructure probe was performed.

Documentation

No documentation changes are required; the public API is unchanged.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the encoding change follows the transport contract and is covered at the resulting request boundary.

Summary

• Encodes session IDs with rawurlencode() before interpolating them into the send endpoint.
• Adds request-level coverage for path separators, traversal-like strings, URL delimiters, percent escapes, spaces, and plus signs.
• Preserves the POST method and empty JSON-object request body.

_{Reviews (1) · Last reviewed commit: "fix(passwordless): encode session IDs in..."}