OAuth Authorization Code Parameter Not URL-Encoded in Token Exchange Request

## Issue: FINDING-067 - OAuth Authorization Code Parameter Not URL-Encoded in Token Exchange Request

**Labels:** bug, security, priority:medium, asvs-level:L1, asvs-level:L2

**ASVS Level(s):** [L1, L2]

**Description:**

### Summary
The OAuth authorization code parameter is not URL-encoded before being interpolated into the token exchange request URL to oauth.apache.org. While `urllib.parse.quote()` is imported and used extensively in the same file for other OAuth parameters, it is not applied to the 'code' parameter. This allows an attacker to inject additional query parameters into the token exchange request. Per RFC 6749 §4.1.2, authorization codes can contain any printable ASCII character including &, =, ?, and #, which enables parameter injection attacks.

### Details
**Affected Files and Lines:**
- `src/asfquart/generics.py:97` - Code parameter without URL encoding

The authorization code is interpolated directly into the URL without encoding, allowing special characters to inject additional parameters.

### Recommended Remediation
Apply `urllib.parse.quote()` to the OAuth code parameter before URL interpolation:

```python
encoded_code = urllib.parse.quote(code, safe='')
rv = await session.get(OAUTH_URL_CALLBACK % encoded_code)
```

Additionally, consider using `create_secure_session()` from `atr/util.py` instead of plain `aiohttp.ClientSession` to enforce TLS 1.2+, explicit certificate verification, hostname checking, and secure cipher suite selection for defense-in-depth.

### Acceptance Criteria
- [ ] Code parameter URL-encoded
- [ ] Parameter injection prevented
- [ ] Hardened TLS session considered
- [ ] Integration test verifies encoding
- [ ] Unit test verifying the fix

### References
- Source reports: L1:1.2.2.md, L2:1.3.6.md
- Related findings: FINDING-068
- ASVS sections: 1.2.2, 1.3.6

### Priority
Medium