Restore url.PathEscape on user-supplied path segments in url.JoinPath calls

url.JoinPath does not percent-encode slashes or reserved characters in
its arguments, so user-supplied values (group IDs, slugs, team IDs) must
be wrapped with url.PathEscape to prevent path traversal. Update cursor
rule and contrib guide to codify this as a mandatory practice.

Signed-off-by: Émile Ré <emile@probo.com>

.cursor/rules/go-url-construction.mdc

@@ -10,14 +10,19 @@ alwaysApply: false
 
 Use `net/url` package or `pkg/baseurl.URLBuilder`.
 
+**Always** wrap user-supplied path segments with `url.PathEscape` before passing them to `url.JoinPath`. `url.JoinPath` does **not** percent-encode slashes or reserved characters in its arguments — a value like `parent/child` silently adds an extra path segment.
+
 ```go
 // BAD
 endpoint := fmt.Sprintf("https://api.example.com/users/%s?active=%t", userID, active)
 endpoint := "https://api.example.com/orgs/" + orgID + "/members"
 raw := baseEndpoint + "?domain=" + domain + "&limit=100"
 
-// GOOD — url.JoinPath + url.Values
-u, err := url.JoinPath("https://api.example.com", "users", userID)
+// BAD — user-supplied value without PathEscape
+u, err := url.JoinPath("https://api.example.com", "groups", groupID, "members")
+
+// GOOD — url.JoinPath with PathEscape + url.Values
+u, err := url.JoinPath("https://api.example.com", "groups", url.PathEscape(groupID), "members")
 if err != nil {
 	return fmt.Errorf("cannot build URL: %w", err)
 }