Windows sbom have strange % in purl/sbom-ref

**What happened**:
I tried to generate a sbom with syft on a windows system.
To avoid intrusion on a working unconnecter system
- I booted a linux stick on said system,
- mounted windows disk on /mnt
- launched syft like that
```
syft scan dir:/mnt -o cyclonedx=sbom.json
```
I tried to import said sbom on dependency track got an error :
```
Caused by: org.datanucleus.exceptions.NucleusUserException: Attempt to store value "pkg:nuget/Microsoft%20Reporting%20Services%20%FFFFFFC3%FFFFFF92%FFFFFFC2%FFFFFF9B%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF8B%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB7%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBC%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF80%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%20%FFFFFFC3%FFFFFF92%FFFFFFC2%FFFFFFAF%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF88%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBD%20ADO.NET%20%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB4%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF80%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBA%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF80%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBD%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF92%FFFFFFC2%FFFFFFA3%20%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB6%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBA%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB7%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF83%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF88%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF81%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFFAF%FFFFFFC2%FFFFFFBF%FFFFFFC2%FFFFFFBD@11.0.9165.1186" in column "PURLCOORDINATES" that has maximum length of 786. Please correct your data!
```
I searched that string in the json file -> nothing
But some of the the sbom-ref or purl fields were strange:
```
bom-ref": "pkg:nuget/Microsoft%20Reporting%20Services%20%D0%BF%D1%80%D0%BE%D1%88%D0%B8%D1%80%D0%B5%D1%9A%D0%B5%20%D0%BF%D0%BE%D0%B4%D0%B0%D1%82%D0%B0%D0%BA%D0%B0%20%D0%B7%D0%B0%20Analysis%20Services@11.0.9165.1186?package-id=9ddc785f7a23aa1b",
```

**What you expected to happen**:
Get readable & short fields

**Anything else we need to know?**:
It seems to be urlencoded: I found that "pkg:nuget/Microsoft%20Reporting%20Services%20%D0%BF%D1%80%D0%BE%D1%88%D0%B8%D1%80%D0%B5%D1%9A%D0%B5%20%D0%BF%D0%BE%D0%B4%D0%B0%D1%82%D0%B0%D0%BA%D0%B0%20%D0%B7%D0%B0%20Analysis%20Services@11.0.9165.1186" decodes as "pkg:nuget/Microsoft Reporting Services проширење података за Analysis Services@11.0.9165.1186"

**Environment**:
- Output of `syft version`: 1.18.1
- OS (e.g: `cat /etc/os-release` or similar): ubuntu 24 on the stick, windows 10 ltsc on the system

Reproduce the report with `syft scan dir:/mnt -o cyclonedx=sbom.json` and inspect the generated `purl` and `bom-ref` fields for the reported package name. Trace where those CycloneDX values are produced, then verify that the output remains readable and short enough for Dependency-Track to import successfully.

Written by the indexing model from the issue text.