Implement URL normalization in code snippet handler

[onerandomusername]

Add URL normalization checks using yarl in code snippets.

closes #3315

Thanks to @decorator-factory for the idea.

---

tested on @pydis-bot and deployed on @monty-python-bot

[jb3]

Looks good, should we add & pin yarl as we are now explicitly using it? (I know it's present as a dependency of aiohttp but we should probably pin it ourselves).

[jb3]

Solid, thanks!

[wookie184]

There is some potential for false positives here as there is nothing inherently wrong with an unnormalised URL. I don't think it's really an issue because I can only think of examples that you would have to craft on purpose, e.g. if you percentage encode part of the URL (e.g. if you had a file called # or ? :D) and decide to do it in lowercase %3f, yarl will normalise to uppercase %3F.

This is definitely better than allowing arbitrary requests to be made, and I can't really think of a neater approach.

Ideally we would probably have a helper we can use everywhere when substituting stuff into URLs (possibly a nice use case for PEP 750...). Even this ends up being a bit difficult to do perfectly though, as some URL parameters need to be more permissive than others, and it's not always clear when to quote vs when to just reject something.

[onerandomusername]

Let me check that before you merge

[onerandomusername]

Tested on this branch, seems to work:

Meanwhile, on main:

raw url tested: https://github.com/onerandomusername/ghre-tester/blob/9be3025d879813db5f6524338002539ad0264e45/README.md%3Fplain%3D1#L1

[wookie184]

Never mind I just misread the code, I see no issues with this