use URI::file for (de)serialising paths in XML

[xworld21]

Use URI::file for serialising and deserialising paths written to XML for @graphic, @candidates, and the processing instructions 'searchpaths' and 'graphicspath'. It also replaces previous manual uses of URI::file.

This prevents potential issues regarding:

• OS-specific path separators: backslashes on Win32 will never leak into XML
• absolute paths: URI::file will add file:// when the paths is absolute, including on Windows for paths starting with e.g. C: (or longpaths, but LaTeXML does not support those yet)
• spaces, commas, Unicode, etc: URLs are automatically encoded and decoded
• lists of URLs: multiple URLs are now space separated, which is safe, since spaces within URLs will be percent-encoded

Note that I have replaced the previous implementation of pathname_to_url as it didn't make sense to have two. I have adjusted CrossRef accordingly.

This supersedes #2367 and fixes #2355 (well, I haven't tried it on a Windows machine yet, but I am sure it does).