Document nested URL encoding rejection behavior

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

README.md

@@ -33,6 +33,7 @@ or whitespace/newline characters.
 `base_url` must not include embedded user credentials.
 If a port is provided in `base_url`, it must be a valid numeric port.
 Unsafe encoded host/path forms (for example encoded traversal segments or encoded host/path delimiters) are also rejected.
+Excessively nested URL encoding in base URLs and internal API paths is rejected.
 The SDK normalizes trailing slashes automatically.
 If `base_url` already ends with `/api`, the SDK avoids adding a duplicate `/api` prefix.
 If `HYPERBROWSER_BASE_URL` is set, it must be non-empty.