fix: encode paths when loading XML schemas

[CAOShurong]

Description

lxml 5.x treats the path passed to XMLSchema(file=...) as a URL. When the local package path contains #, the fragment handling changes the base URL and the relative spdx.SNAPSHOT.xsd import is not resolved.

This change converts the absolute local schema path to an encoded file: URI before loading it. It also adds a regression test that copies the bundled schemas beneath a path containing # and validates a minimal CycloneDX 1.6 document.

Resolves or fixes issue: #551

Validation

• Regression test reproduced the XMLSchemaParseError with lxml 5.3.2/libxml2 2.12.10 before the fix and passes after it.
• The same test passes with lxml 4.9.4, 5.3.2, and 6.1.1 on Windows or WSL as available.
• Full suite: 6,962 tests passed on Python 3.13.
• poetry run tox run -e py313-allExtras,py313-noExtras,flake8,mypy-current,mypy-lowest,bandit,deptry
• poetry build produced both wheel and sdist.
• The built wheel was installed into a clean WSL environment whose site-packages path contains #; generated CycloneDX 1.6 XML passed XmlValidator with lxml 5.3.2.

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: OpenAI Codex
  • LLMs and versions: GPT-5
  • Prompts: Research maintainer-confirmed issue #551, reproduce it with supported lxml versions, implement the smallest local-file URI compatibility fix, add a regression test, and run the repository's complete checks and package smoke test.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[jkowalleck]

released via https://github.com/CycloneDX/cyclonedx-python-lib/releases/tag/v11.11.2