fix: escape sessionId in VertexAiClient request paths

[Tulgaaaaaaaa]

Problem

VertexAiClient concatenates the session id straight into the Vertex AI REST path:

"reasoningEngines/" + reasoningEngineId + "/sessions/" + sessionId

Session ids reach the client from user-supplied Session objects, so a session id
containing / or .. can retarget the request at a different resource, and one
containing ? can append arbitrary query parameters to the request.

Fix

Escape the session id as a single URL path segment with
UrlEscapers.urlPathSegmentEscaper() in listEvents, getSession, deleteSession
and appendEvent.

Two values in this class were already safe and are left alone:

• reasoningEngineId is constrained to digits by VertexAiSessionService.parseReasoningEngineId.
• userId in listSessions is already wrapped as a quoted AIP-160 literal and
  form-escaped on main, so the original version of this PR (which replaced that
  with a bare URLEncoder.encode) would have been a regression. Rebased away.

UrlEscapers is used rather than URLEncoder.encode, which is HTML form encoding —
it turns a space into +, which is a literal + in a path segment.

Tests

New VertexAiClientTest — 12 tests using Mockito ArgumentCaptor to assert on the
exact path handed to HttpApiClient.request:

• path traversal is neutralised: ../../secret → ..%2F..%2Fsecret
• query-string injection is neutralised: 456?view=FULL → 456%3Fview=FULL
• normal ids are untouched: reasoningEngines/123/sessions/456
• the :appendEvent custom verb and the listEvents filter parameter still survive escaping
• listSessions regression cover for the existing AIP-160 quoting

Notes for reviewers

Rebased onto current main as a single commit — merge conflicts resolved, and the
listEvents(reasoningEngineId, sessionId, filter) signature that the earlier version
of this branch had dropped is preserved, which is what was breaking the Maven build.

Verified locally: ./mvnw test -Dtest=VertexAiClientTest (12/12), the existing
VertexAiSessionServiceTest (30/30), and a full-project test-compile.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[hemasekhar-p]

Hi @Tulgaaaaaaaa, thank you for your contribution! We appreciate you taking the time to submit this pull request. To proceed with the review, could you please address the following,

1. Please address the merge conflicts
2. As per our contribution policy, please squash your changes into a single commit
3. Please resolve the current Maven build failures.

[Tulgaaaaaaaa]

Hi, I've addressed the requested changes:

• Resolved the merge conflicts
• Squashed the commits into a single commit
• Fixed the Maven build issues

Could you please review the updated PR when you have time? Thank you!

[hemasekhar-p]

@Tulgaaaaaaaa, thank you for addressing the feedback and making those updates. Currently this PR is under review by our team, we will keep you posted if any additional information is required. thank you