fix: stop splitting query parameters on semicolons

[Yanhu007]

Summary

Fixes #781

findFirstQueryKey splits query-parameter pairs on both & and ;. Since Go 1.17, net/url.ParseQuery only splits on &, per the URL Living Standard.

This parser differential can enable:

• Web cache poisoning via query-parameter cloaking
• Broken access control when applications use both net/url and mux.Vars for parsing

Change

// Before — splits on both & and ;
if i := bytes.IndexAny(foundKey, "&;"); i >= 0 {

// After — only splits on & (matching Go stdlib and URL Living Standard)
if i := bytes.IndexByte(foundKey, '&'); i >= 0 {

Tests

All existing tests pass (go test ./...), including Test_findFirstQueryKey which validates against url.ParseQuery.

[Yanhu007]

Duplicate of #798, closing this one.