feat(gax): implement secure rest-special-uri-chars guidelines for fallback transcoder

[danieljbruce]

This PR implements the approved, lang-neutral rest-special-uri-chars security guidelines for the REST fallback transcoding layer. This provides full protection against both path traversal and parameter injection attacks. It also includes comprehensive unit tests in google-gax and integration-level tests in google-cloud-dialogflow-cx to verify safety.

---

PR created automatically by Jules for task 462466416141264086 started by @danieljbruce

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request introduces path traversal validation to the REST fallback transcoding logic in google-gax. It ensures that single-asterisk (*) and double-asterisk (**) wildcard segments in path templates do not resolve to "." or ".." segments, throwing errors if invalid paths are detected. The changes also update encoding functions and add comprehensive unit tests. The review feedback highlights two potential runtime TypeError crashes: one when calling value.toString() on potentially null or undefined array elements in buildQueryStringComponents, and another when calling groupVal.split('/') on optional, unmatched regex capturing groups in applyPattern.

[gemini-code-assist]

If an element in the array is null or undefined, calling value.toString() will throw a TypeError. Adding a defensive check to handle null/undefined values safely prevents potential runtime crashes.

Suggested change

	`${prefix}${encodeWithoutSlashes(key, key)}=${encodeWithoutSlashes(
	value.toString(),
	key,
	)}`,
	`${prefix}${encodeWithoutSlashes(key, key)}=${encodeWithoutSlashes(
	value === null || value === undefined ? 'null' : value.toString(),
	key,
	)}`

[gemini-code-assist]

If a capturing group in the matched regex is optional and does not match, groupVal can be undefined. Calling groupVal.split('/') on an undefined value will throw a TypeError. Adding a defensive check to skip null or undefined group values ensures robustness.

  const capturedGroups = match.slice(1);
  for (let i = 0; i < capturedGroups.length; i++) {
    const groupVal = capturedGroups[i];
    if (groupVal === undefined || groupVal === null) {
      continue;
    }
    const wcType = wildcards[i];