Ensure that public HostSource ctor URL encodes comma and semicolon characters

[shekyan]

While discussing #165 (comment), we agreed that semicolons are allowed by source expression grammar (path-part, in particular. ). However, semicolon is a directive delimiter, and comma is a policy delimiter.

While it is not possible to parse a policy that whitelists a URL containing ; or ,, it should be possible to parse and match percent encoded versions of such URLs. https://w3c.github.io/webappsec-csp/#match-paths covers this part by requiring to percent decode paths before matching.