Repository: pantsbuild/pants

Issue:
Pants 2.19 fails to download WHLs with URL-escaped chars
**Describe the bug**
Pants 2.19 fails to download WHL files hosted on URLs that contain URL-escaped characters. This applies to both URLs already present in the lockfile and to URLs retrieved during `generate-lockfiles`.

For example, instead of:
https://download.pytorch.org/whl/cpu/torch-2.0.1%2Bcpu-cp311-cp311-linux_x86_64.whl
it attempts (and fails) to download:
https://download.pytorch.org/whl/cpu/torch-2.0.1+cpu-cp311-cp311-linux_x86_64.whl

Seems to be related to the `v2.1.148` PEX version, as downgrading to `v2.1.137` resolves the issue

**Pants version**
2.19.0

**OS**
Both MacOS and Linux

**Additional info**
Minimalist example to reproduce:

```BUILD
python_requirement(
    requirements=["torch==2.0.1+cpu"],
)
```

```pants.toml
[GLOBAL]
pants_version = "2.19.0"

backend_packages = [
  "pants.backend.python",
]

[python]
interpreter_constraints = ["==3.11.*"]
enable_resolves = true

[python-repos]
find_links = [
    "https://download.pytorch.org/whl/torch_stable.html",
]

# Workaround: Downgrade to a previous PEX version
#[pex-cli]
#known_versions = [
#  "v2.1.137|macos_arm64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329",
#  "v2.1.137|macos_x86_64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329",
#  "v2.1.137|linux_x86_64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329",
#  "v2.1.137|linux_arm64|faad51a6a108fba9d40b2a10e82a2646fccbaf8c3d9be47818f4bffae02d94b8|4098329"
#]
#version = "v2.1.137"

```


Discussion:
I tried to bisect with:
```
$ python3.10 -m pex.cli lock create --interpreter-constraint $'CPython==3.11.*' --style=universal --pip-version=23.1.2 --resolver-version pip-2020-resolver --find-links=https://download.pytorch.org/whl/torch_stable.html  "torch==2.0.1+cpu" -o tmp/tmp.lock
```

and ended up at https://github.com/pantsbuild/pex/commit/45eea4bb274b65bc185e1ea8cfc67f507209aea0
Thanks @cburroughs. Wonder if this is something Pants does wrong when invoking Pex or if it's a Pex issue. I see a few added unquote f.ex., which would lead to the issues observed if not quoted on-use. 

For clarity, can you show the same regression with extra-indexes as well? Or is this find-links specific code paths?
> For clarity, can you show the same regression with extra-indexes as well? Or is this find-links specific code paths?

If someone knows of a package on PyPi that uses the `+` syntax I'm happy to try to concoct a test, but I didn't know that was valid before today.
It's a local version specifier, and I don't think PyPi would accept them -- they're meant for distro patches, primarily. Torch using them for API spec is... a stretch, semantically. I did a test myself using torch's extra index and couldn't repro, so seems like find-links is the issue.

Resolving patch:
diff --git a/src/python/pants/backend/python/util_rules/pex_cli.py b/src/python/pants/backend/python/util_rules/pex_cli.py
--- a/src/python/pants/backend/python/util_rules/pex_cli.py
+++ b/src/python/pants/backend/python/util_rules/pex_cli.py
@@ -35,7 +35,7 @@ class PexCli(TemplatedExternalTool):
     name = "pex"
     help = "The PEX (Python EXecutable) tool (https://github.com/pantsbuild/pex)."
 
-    default_version = "v2.1.159"
+    default_version = "v2.1.162"
     default_url_template = "https://github.com/pantsbuild/pex/releases/download/{version}/pex"
     version_constraints = ">=2.1.135,<3.0"
 
@@ -46,8 +46,8 @@ def default_known_versions(cls):
                 (
                     cls.default_version,
                     plat,
-                    "83c3090938b4d276703864c34ba50bcb3616db0663c54b56dd0521a668d9555f",
-                    "3671772",
+                    "95babb1aa147e2803b7744ba0c025aede8e5fc00322ed535675a51563672486b",
+                    "3676166",
                 )
             )
             for plat in ["macos_arm64", "macos_x86_64", "linux_x86_64", "linux_arm64"]


Test patch: