Package details page URLs use '?' rather than '%3F', and VCIO disregards the portion of the PURL starting with '?'

While working on https://github.com/nexB/vulnerablecode/issues/1287, I noticed that when the results of a UI Package search query for a PURL with a qualifier include a PURL with a qualifier, the PURL displayed in the Package search results list uses '?' as the separator indicating that a qualifier follows, but the actual URL uses the ASCII-encoded '%3F'. Clicking such a link takes the user to the intended Package details page for the PURL with a qualifier.

However, the URLs displayed on the Package details page for any PURL with a qualifier use '?' rather than '%3F'. As a result, clicking such a link does not take the user to the page for the PURL with the qualifier. Instead, VCIO disregards that portion of the URL that starts with '?' -- if the PURL string up to the '?' identifies a Package in the database, clicking that link takes the user to that PURL *without* a qualifier, but if there is no such PURL in the database, a page-not-found/404 is returned instead.

A quick check of the API suggests there is no similar issue with the URL or PURL data there but this needs a more thorough check to be certain.

Related issues:
- https://github.com/nexB/vulnerablecode/issues/1508
- https://github.com/nexB/vulnerablecode/issues/1287