[BUG] Scoped npm packages trigger false positives or crash in HallucinationChecker

[KbWen]

Describe the bug

When scanning package.json files containing scoped npm packages (e.g., @types/node or @babel/core), the HallucinationChecker fails to check them properly or incorrectly flags them.

Specifically, in src/ghostcheck/checks/hallucination.py:

def _check_npm_online(self, pkg_name):
    url = f"https://registry.npmjs.org/{pkg_name}"
    # ...

For scoped packages, the package name contains a slash (e.g., @babel/core). When formatted into the URL, it becomes https://registry.npmjs.org/@babel/core. While this is the correct endpoint, if the registry API expects URL-escaped slashes (%2F) or if proxy/request settings strip or alter this format, it can fail.

Also, we need to ensure that package names with special characters are properly URL-encoded (using urllib.parse.quote) before making registry requests.

Steps to reproduce

1. Create a package.json with a scoped dependency (e.g., "@nonexistent/package": "^1.0.0").
2. Run ghostcheck scan.
3. Observe behavior.

Expected behavior

Package names should be properly URL-encoded (using urllib.parse.quote) before querying registries like npm or PyPI, ensuring compatibility and reducing false-positive connection errors.