productbuild: use curl to escape pkg-ref urls

Fixes: #18645
1 job for encode-cpack-pkg-file-urls