fix: encode & and + in modelarmor create-template query value

build_create_template_url embeds template_id into a query string via
raw format!(), not a .query() builder. encode_path_segment (this PR's
prior commit) deliberately leaves & and + unencoded since both are
legal in a bare path segment — but neither is safe in a query string:
an unencoded & splits the value into two parameters (silently
truncating the intended template_id), and + is commonly decoded
server-side as a space.

validate_resource_name (which template_id passes through first) does
not reject & or +, so this was reachable from --template-id input.
Confirmed by compiling and running url::Url::parse against the actual
encode set before this fix.

Add a fork-local encode_query_value in modelarmor.rs rather than
reusing/exporting validate::encode_path_segment's encode set, so that
function can stay a byte-for-byte match with the upstream fix (googleworkspace#867)
it backports.

Author: shigechika

crates/google-workspace-cli/src/helpers/modelarmor.rs

@@ -366,14 +366,53 @@ fn parse_create_template_args(matches: &ArgMatches) -> Result<CreateTemplateConf
     })
 }
 
+/// Percent-encode a value for use as a query parameter value in a URL built
+/// by string formatting (rather than a `.query()` builder). `encode_path_segment`
+/// is NOT safe here: `&` and `+` are legal in a bare path segment (so it
+/// leaves them intact), but both are structurally significant in a query
+/// string — an unencoded `&` splits the value into two parameters, and `+` is
+/// commonly decoded server-side as a space. This mirrors
+/// `validate::encode_path_segment`'s encode set plus those two extra bytes
+/// (duplicated rather than shared, so that function can stay a byte-for-byte
+/// match with the equivalent upstream fix).
+fn encode_query_value(s: &str) -> String {
+    use percent_encoding::{utf8_percent_encode, AsciiSet, CONTROLS};
+
+    const QUERY_VALUE_ENCODE_SET: &AsciiSet = &CONTROLS
+        .add(b' ')
+        .add(b'"')
+        .add(b'#')
+        .add(b'%')
+        .add(b'&')
+        .add(b'+')
+        .add(b'<')
+        .add(b'>')
+        .add(b'?')
+        .add(b'`')
+        .add(b'{')
+        .add(b'}')
+        .add(b'/')
+        .add(b':')
+        .add(b';')
+        .add(b'=')
+        .add(b'@')
+        .add(b'[')
+        .add(b'\\')
+        .add(b']')
+        .add(b'^')
+        .add(b'|');
+
+    utf8_percent_encode(s, QUERY_VALUE_ENCODE_SET).to_string()
+}
+
 pub fn build_create_template_url(config: &CreateTemplateConfig) -> String {
     let base = regional_base_url(&config.location);
     let project = crate::validate::encode_path_segment(&config.project);
     let location = crate::validate::encode_path_segment(&config.location);
     let parent = format!("projects/{project}/locations/{location}");
     format!(
         "{base}/{parent}/templates?templateId={}",
-        crate::validate::encode_path_segment(&config.template_id)
+        encode_query_value(&config.template_id)
     )
 }
 
@@ -763,6 +802,24 @@ mod parsing_tests {
         assert!(url.contains("templateId=my%20template"));
     }
 
+    #[test]
+    fn test_build_create_template_url_encodes_query_delimiters_in_template_id() {
+        // Regression test: template_id lands in a query string built by raw
+        // string formatting, not a `.query()` builder. `encode_path_segment`
+        // deliberately leaves `&`/`+` intact (they're legal in a bare path
+        // segment), so using it here would let `&` split templateId into two
+        // query parameters, and `+` would be decoded server-side as a space.
+        let config = CreateTemplateConfig {
+            project: "p".to_string(),
+            location: "us-central1".to_string(),
+            template_id: "my&extra+id".to_string(),
+            body: "{}".to_string(),
+        };
+        let url = build_create_template_url(&config);
+        assert!(url.contains("templateId=my%26extra%2Bid"));
+        assert!(!url.contains("templateId=my&extra"));
+    }
+
     #[test]
     fn test_parse_create_template_args_rejects_traversal() {
         let matches = make_matches_create(&[