Group information not correctly escaped (OA4MP)

[bbockelm]

When the embedded OA4MP issuer is used, it does not correctly escape the generated group path.

For example, I created the following authorization:

   - actions: ["read"]
     prefix: /groupdir/$GROUP

and COManage has me in a group named "CO:COU:Topology Contacts:members:active".

The resulting scope was:

storage.read:/groupdir/CO:COU:Topology Contacts:members:active

Spaces are significant for the scope list -- we should adjust the QDL logic so the resulting scopes are URL-escaped.