- Add url_decode function to handle percent-encoded sequences
- Check both raw and URL-decoded paths for traversal attacks
- Catch %2e%2e%2f (encoded ../) and similar bypasses
- Improved path traversal detection for patterns like /etc/../passwd

Fixes TPol-identified vulnerabilities:
- URL-encoded path traversal bypasses
- Missing path traversal detection in some patterns

Add validate function to uRI.ml that checks for:
- Acceptable schemes: http, https, ftp, sftp, file, ssh, git, darcs, pijul, fossil
- Path traversal attacks (../, ..\ patterns)

Returns Result type with specific error variants for invalid schemes
and path traversal attempts.

All 17 tests pass.