[vishr]

Summary

Fixes #3206.

Both trailing-slash middlewares now use the escaped path to decide whether to add or remove a literal slash and to construct RequestURI or Location. Forward mode keeps an existing URL.RawPath synchronized with URL.Path, so the router sees the updated path.

- /files/a%2Fb -> redirect /files/a/b/ -> 404
- /files/a%2Fb -> forward with stale RawPath -> 404
+ /files/a%2Fb -> /files/a%2Fb/ -> same route and parameter

Encoded separators stay path data, including leading %2F/%5C and a final %2F inside a parameter. Query strings are appended once per middleware. sanitizeURI is unchanged from master and still normalizes literal leading slashes/backslashes.

Related: #3134 and #3207. This change covers both forwarding and redirecting.

Evidence

• Before: redirects decode escaped separators, while forwarding leaves RawPath stale. Tests reproduce a missing add-slash route, an incorrect remove-slash parameter, and resource changes caused by normalizing encoded leading or final separators.
  After: redirect-following and forward-mode tests reach the expected route with the original parameter, including a%2F as the final segment. Spaces, question marks, fragments, Unicode, query strings, and existing RawPath presence are covered.
• Existing backslash expectations now retain percent encoding. Literal double-slash and control-character sanitization tests still pass.
• Independent branch: GOTOOLCHAIN=go1.27.4 go test -race ./..., go vet ./..., golint -set_exit_status ./..., and current staticcheck pass.

Merge Danger

Door: two-way

Blast Radius: routing

Forwarding now keeps the escaped router path consistent. Redirects preserve escaped bytes; an encoded final slash remains parameter data rather than being removed or mistaken for an existing literal trailing slash.