fix: Escape package names in UsersService methods

[pucedoteth]

UsersService.GetPackage escapes packageName, but the other seven package methods interpolate it raw, so a name containing a slash produces a malformed path. Container and scoped npm package names routinely contain one.

OrganizationsService already escapes it in all seven equivalent methods and documents it, so this just brings the user methods in line: 12 call sites escaped, plus the same doc note.

The existing tests missed this because only the GetPackage test uses a slashed name (hello/hello_docker); the rest use hello_docker. The new test uses a slashed name against every affected method — all ten sub-cases fail without the change and pass with it.

AI assistance: Claude Code found the inconsistency, made the edits, and drafted the test and this description. I reviewed the diff and ran script/fmt.sh, script/generate.sh (no drift), script/lint.sh and script/test.sh.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.54%. Comparing base (2433615) to head (f02b3f2).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4545   +/-   ##
=======================================
  Coverage   98.54%   98.54%           
=======================================
  Files         196      196           
  Lines       17938    17938           
=======================================
  Hits        17677    17677           
  Misses        261      261           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gmlewis]

@pucedoteth - for the CLA issue, chances are high that Anthropic will never sign the CLA and the following contributors were found for this pull request:

✅ f02b3f2 Author: @pucedoteth <119044801+pucedoteth​@users.noreply.github.com>
❌ f02b3f2 Co-Author: <no****y​@anthropic.com>

So I recommend that you CLOSE this PR and create a new PR where YOU are the only committer.

[pucedoteth]

Thanks @gmlewis — closing in favour of #4546, which has the same change with me as the only committer. The AI disclosure is in that PR's description instead, per CONTRIBUTING.