locationsFoundAt specifies URL-encoded paths

As per the title, e.g.:

{
  "dependencyGraphs": {
    "C:\\src\\my project\\my project.csproj": {
      ...
    }
  },
  "componentsFound": [
    {
      "locationsFoundAt": [
        "/my%20project/my%20project.csproj"
      ],
      ...
    }
  ]
}

This behaviour means that paths including spaces are mangled. This affects downstream uses like https://github.com/advanced-security/component-detection-dependency-submission-action - because the paths are different between "dependencyGraphs" and "componentsFound", it fails to link them, and I get a bunch of warnings like

 Warning: No dependency graph entry found for manifest location: my%20project/my%20project.csproj

I have identified where this URL-encoding is being applied, and have a fix that I will push soon.

Start at the URL-encoding location identified by the reporter and reproduce the issue with a project path containing spaces, comparing dependencyGraphs with componentsFound.locationsFoundAt. Done means both representations use the same unencoded path and downstream processing no longer reports a missing dependency graph entry.