fix(url): escape cmd.exe special chars in vim.ui.open() URL #41394

Problem:
On Windows, vim.ui.open() passes URLs to `cmd.exe /c start`. cmd.exe
treats `&` as a command separator, so query strings are truncated.

Solution:
Caret-escape `&|<>^%!` in URIs when the open handler is cmd.exe.

runtime/lua/vim/ui.lua

@@ -199,6 +199,8 @@ function M.open(path, opt)
     if open_cmd[1] == 'xdg-open' then
       job_opt.stdout = false
       job_opt.stderr = false
+    elseif open_cmd[1] == 'cmd.exe' and is_uri then
+      path = path:gsub('([&|<>^%%!])', '^%1') -- Escape cmd.exe special chars. #41337
     end
     cmd = vim.list_extend(open_cmd, { path })
   end