Utility does not pass a valid iri-reference as value in `externalReference` url field

## Describe the bug

The value "http://private%20package/" is a valid `iri-reference`.

## Screenshots or output-paste
Problematic part of the SBOM file:
```
{
"type": "library",
"name": "utils",
"group": "@mui",
"version": "5.14.17",
"bom-ref": "pkg:npm/%40mui/utils@5.14.17?vcs_url=git%2Bhttps%3A//github.com/mui/material-ui.git#packages/mui-utils",
"author": "MUI Team",
"description": "Utility functions for React components.",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"purl": "pkg:npm/%40mui/utils@5.14.17?vcs_url=git%2Bhttps%3A//github.com/mui/material-ui.git#packages/mui-utils",
"externalReferences": [
{
"url": "https://github.com/mui/material-ui/issues",
"type": "issue-tracker",
"comment": "as detected from PackageJson property \"bugs.url\""
},
{
"url": "git+https://github.com/mui/material-ui.git#packages/mui-utils",
"type": "vcs",
"comment": "as detected from PackageJson property \"repository.url\" and \"repository.directory\""
},
{
"url": "http://private%20package",
"type": "website",
"comment": "as detected from PackageJson property \"homepage\""
}
]
},
```

Util output:


## Expected behavior

Validation passed

## Additional context

At first I thought that the problem was in the sbom file generator, and created a [issue for it](https://github.com/CycloneDX/cyclonedx-webpack-plugin/issues/1359). Perhaps it will also be interesting