%-decodes the passed-in URL *in place*.
The decoded version is never longer than the encoded version, so there does not need to be any additional space at the end of the string.
a URL part