reproducible-central report: artifact coordinates not URL-encoded in badge URL

`ReproducibleCentralReport.renderReproducibleCentralArtifact()` (lines 175-178) interpolates POM coordinates directly into URLs without encoding:

```java
String badge = "https://img.shields.io/reproducible-central/artifact/" + groupId + '/' + artifactId + '/'
+ version + "?labelColor=1e5b96";
```

The report is generated for the project being sited, but `group-id`/`artifactId`/`version` come from the POM (arbitrary user input for third-party projects) and are passed straight into `sink.figureGraphics(...)`. A version containing characters such as `&`, `?`, `#`, `"`, or `/` produces:
- a broken/misleading badge image (wrong query string), and
- potentially malformed/foreign HTML in the generated site report (stored-HTML injection in published project sites).

Suggested fix: URL-encode each coordinate segment (e.g. `URLEncoder.encode(..., StandardCharsets.UTF_8)`) before building the URL.

Start at ReproducibleCentralReport.renderReproducibleCentralArtifact(), specifically lines 175-178, and inspect how the POM coordinates are inserted into the badge URL before sink.figureGraphics(...). Encode each coordinate segment as suggested, then verify that special characters remain part of the URL path and cannot alter the generated report markup.

Written by the indexing model from the issue text.