[BUG] RequestConfigHelper.buildPath does not URL-encode path/query values

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java:187-216`
- description: Path parameters substituted via `modifiedBasePath.replace("{{." + key + "}}", value)` and query via `queryBuilder.append(key).append("=").append(value)` with no URL encoding. Values containing `&`, `=`, `#`, `/`, `+`, `%` corrupt the path/query (e.g., `&` in a query value injects an extra parameter).
- impact: Malformed downstream URLs / query-parameter injection for values containing reserved characters.
- suggested_fix: URL-encode path segments and query values.
- confidence: High
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java:187-216 and trace how buildPath receives path and query values. Verify behavior with values containing &, =, #, /, +, and %, then confirm that generated downstream paths and queries preserve each value without injection or corruption.

Written by the indexing model from the issue text.