`cabal install` with qualified component leads to `curl` exception

`cabal install` with qualified component leads to `curl` exception:
```
$ cabal install cabal-plan:exe:cabal-plan
Downloading cabal-plan:exe:cabal-plan
Error: cabal: '/usr/local/opt/curl/bin/curl' exited with an error:
curl: (3) URL using bad/illegal format or missing URL
```
Correct error given in 3.2:
```
$ cabal-3.2 install cabal-plan:exe:cabal-plan
cabal-3.2: Invalid package ID: cabal-plan:exe:cabal-plan
```

(I wonder whether this could be exploited: injecting code into the `curl` request. In any case, sanitization seems to be missing.)

Reproduce `cabal install cabal-plan:exe:cabal-plan` and compare its behavior with `cabal-3.2`, which reports an invalid package ID. Trace package-ID validation and the subsequent `curl` request construction; done means the qualified component is rejected safely with a clear error and does not produce a malformed request. Add or update a regression test if the relevant test location can be identified.

Written by the indexing model from the issue text.