UBUNTU-CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes...