With a custom form, how to sanitize user input before query gets to URL?
Drupal's mantra is to sanitise upon output, not input. See Writing secure code for Drupal 8 for more information. 

So there's no need to sanitise upon submission, just make sure that if you're rendering that value anywhere, it's done in a secure manner (as explained in the docs above).

If you decide that you still need the solution you've outlined, it's going to have to be implemented in JavaScript. Your form method is GET so the browser handles the input -> URL conversion, not Drupal.