url: do not read past end of buffer

url: do not read past end of buffer

url_decode_internal could have been tricked into reading past the length
of the **query buffer if there are fewer than 2 characters after a % (in
a null-terminated string, % would have to be the last character).
Prevent this from happening by checking len before decoding the %
sequence.

Helped-by: René Scharfe <redacted>
Signed-off-by: Matthew DeVore <redacted>
Signed-off-by: Junio C Hamano <redacted>