Failed to install http dependency with url parameter

Description

Can't install http dependency. Seems like url parameters disturbs the file name resolution.

Background: Gogs (Go Git Server) allows accessing the repositonry files using token, which is provided as an url parameter. Here is the working link in the test repository:
https://try.gogs.io/mrbest/converter/raw/master/HttpDependency.fs?token=2d7f47cff7aaa721336e84a8f605888d525030c6

UPDATE: It works if specify the local path explicitely. See Workaround

Repro steps

• Extract test.zip or do paket init in any empty folder
• add following line to paket.dependencies:

http https://try.gogs.io/mrbest/converter/raw/master/HttpDependency.fs?token=2d7f47cff7aaa721336e84a8f605888d525030c6

• .paket/paket.exe install -v

Expected behavior

Download the file which is otherwise accessible with given url parameter

Actual behavior

Paket version 4.1.6
found: C:\project\path\paket.dependencies
Parsing C:\project\path\paket.dependencies
Paket failed with:
        Illegales Zeichen im Pfad.
StackTrace:
     bei System.Security.Permissions.FileIOPermission.EmulateFileIOPermissionChecks(String fullPath)
   bei System.Security.Permissions.FileIOPermission.QuickDemand(FileIOPermissionAccess access, String fullPath, Boolean checkForDuplicates, Boolean needFullPat
h)
   bei System.IO.FileInfo.Init(String fileName, Boolean checkHost)
   bei Paket.RemoteDownload.downloadDependenciesFile$cont@100[a](String rootPath, ResolvedSourceFile remoteFile, FSharpFunc`2 parserF, GroupName groupName, Boo
lean force, Unit unitVar)
   bei Paket.RemoteDownload.downloadDependenciesFile@97.Invoke(Unit unitVar)
   bei Microsoft.FSharp.Control.AsyncBuilderImpl.callA@841.Invoke(AsyncParams`1 args)
--- Ende der Stapelüberwachung vom vorhergehenden Ort, an dem die Ausnahme ausgelöst wurde ---
   bei Microsoft.FSharp.Control.AsyncBuilderImpl.commit[a](AsyncImplResult`1 res)
   bei Microsoft.FSharp.Control.CancellationTokenOps.RunSynchronouslyInCurrentThread[a](CancellationToken token, FSharpAsync`1 computation)
   bei Microsoft.FSharp.Control.CancellationTokenOps.RunSynchronously[a](CancellationToken token, FSharpAsync`1 computation, FSharpOption`1 timeout)
   bei Microsoft.FSharp.Control.FSharpAsync.RunSynchronously[T](FSharpAsync`1 computation, FSharpOption`1 timeout, FSharpOption`1 cancellationToken)
   bei <StartupCode$Paket-Core>.$DependenciesFile.resolveSourceFile@176.Invoke(ResolvedSourceFile file)
   bei Paket.ModuleResolver.resolve@107(FSharpFunc`2 getDependencies, FSharpFunc`2 getSha1, UnresolvedSource file)
   bei Paket.ModuleResolver.Resolve@173.Invoke(UnresolvedSource file)
   bei Microsoft.FSharp.Primitives.Basics.List.map[T,TResult](FSharpFunc`2 mapping, FSharpList`1 x)
   bei Paket.ModuleResolver.Resolve(FSharpFunc`2 getDependencies, FSharpFunc`2 getSha1, FSharpList`1 remoteFiles)
   bei <StartupCode$Paket-Core>.$DependenciesFile.resolveGroup@173-1.Invoke(GroupName groupName, b _arg1)
   bei Microsoft.FSharp.Collections.MapTreeModule.mapiOpt[a,b,c](FSharpFunc`3 f, MapTree`2 m)
   bei Microsoft.FSharp.Collections.FSharpMap`2.Map[b](FSharpFunc`2 f)
   bei Paket.UpdateProcess.selectiveUpdate(Boolean force, FSharpFunc`2 getSha1, FSharpFunc`2 getSortedVersionsF, FSharpFunc`2 getPackageDetailsF, LockFile lock
File, DependenciesFile dependenciesFile, UpdateMode updateMode, SemVerUpdateMode semVerUpdateMode)
   bei Paket.UpdateProcess.SelectiveUpdate(DependenciesFile dependenciesFile, FSharpOption`1 alternativeProjectRoot, UpdateMode updateMode, SemVerUpdateMode se
mVerUpdateMode, Boolean force)
   bei Paket.UpdateProcess.SmartInstall(DependenciesFile dependenciesFile, UpdateMode updateMode, UpdaterOptions options)
   bei <StartupCode$Paket-Core>.$PublicAPI.Install@179.Invoke(Unit unitVar0)
   bei Paket.Utils.RunInLockedAccessMode[a](String rootFolder, FSharpFunc`2 action)
   bei Paket.Program.main@433-10.Invoke(ParseResults`1 results)
   bei Paket.Program.processWithValidation[T](Boolean silent, FSharpFunc`2 validateF, FSharpFunc`2 commandF, ParseResults`1 result)
   bei Paket.Program.main$cont@420(ParseResults`1 results, Boolean silent, Boolean fromBootstrapper, Unit unitVar)
   bei Paket.Program.main()

Known workarounds

specify fileSpec explicitely:

http https://try.gogs.io/mrbest/converter/raw/master/HttpDependency.fs?token=2d7f47cff7aaa721336e84a8f605888d525030c6 HttpDependency.fs

Start by reproducing the failure with the paket.dependencies entry and trace Paket.RemoteDownload.downloadDependenciesFile from the stack trace. Check how the URL is converted into a local filename, then verify that URLs with query parameters install without an explicit fileSpec while the existing workaround still works.