fix(api-common): validate path template variables against dot segments

[blakeli0]

Validates URI path template variable segments during PathTemplate.instantiate to prevent unintended dot-segment ("." and "..") path traversal and ensures strict percent-encoding of non-unreserved URI characters:

• Reject any path segment equal to "." or ".." in single-segment (*), multi-segment (*), and path wildcard (**) bindings (ValidationException: "Value for %s must not contain segments that are exactly . or ..").
• Encode path variable segments using PercentEscaper("-_.~", false) so all characters outside [-_.~0-9a-zA-Z] are percent-encoded (e.g., spaces as %20, ? as %3F, # as %23, % as %25).

fixes: b/545212190

[gemini-code-assist]

Code Review

This pull request replaces URLEncoder with Guava's PercentEscaper for URL encoding and introduces validation to reject path segments that are exactly '.' or '..' during template instantiation. It also adds comprehensive unit tests to verify these validation rules. The review feedback suggests optimizing the hasPathWildcard helper method by breaking out of the loop early once a path wildcard is found.