Handle % signs in auth properly when followed by numbers

A password like '%1234' would be broken and interpreted as '\u000034' in
the request, becuase it is interpreting the %12 as a percent-encoded
hex, and then it gets broken in the conversion to UTF-8.

Fix npm/npm#6008
Fix npm/npm#5729
Fix npm/npm#5772
Fix npm/npm#5682

Related to npm/npm#5782, but not a fix, since that issue is asking for
the npm client and website to have the *same* set of rules, and this
commit does not guarantee that that is the case.

Forward-ported from the fix on the v2.0 branch: 62f04f00983405afb79c249b574d0da376ac5d7d