CGI.escape slugs when requesting artefacts

Also update test helpers to match this change.

This is necessary to support fetching slugs with a '/' in them
(completed transactions and travel advice).