on around line 214 of {{lib/classes/output/core_renderer.php }}the http meta-refresh tag is generated with the code below:

if ($this->metarefreshtag == '' && $this->page->periodicrefreshdelay !== null) {
            $hook->add_html(
                html_writer::empty_tag('meta', [
                    'http-equiv' => 'refresh',
                    'content' => $this->page->periodicrefreshdelay . ';url=' . $this->page->url->out(),
                ]),
            );
{{        }}}

The URL component of the tag (in RED above) returns the ESCAPED version of the URL, however, the empty_tag function in which it is wrapped escapes the address a SECOND TIME.  Specifically, empty_tag calls the self::attributes which calls self::attribute which calls s($value).

To correct this bug, the part of the line in RED above should be changed to:

$this->page->url->out(false)

which will defer the encoding until the s() function