Treat only & as the urlencoded field separator

[Kludex]

QuerystringParser treated both & and ; as field separators, falling back to a ; scan whenever no & was found. This aligns it with the WHATWG URL standard, under which application/x-www-form-urlencoded bodies are delimited by & only.

; is now ordinary field data. This matches every common encoder - urllib.parse, browser URLSearchParams, httpx, requests, and Rust's serde_urlencoded/reqwest all emit &-separated bodies and none produce ;-separated forms - so no conformant client is affected.

Collapsing the two-step find("&") -> find(";") lookup into a single & search also makes parsing linear in the body length rather than quadratic for ;-heavy inputs, and the search is now bounded by the truncated length so max_size is respected within a chunk.

AI Disclaimer

This PR was developed with the assistance of either Claude or Codex. I've reviewed and verified the changes.

[codspeed-hq]

Merging this PR will not alter performance

✅ 5 untouched benchmarks

---

_{Comparing whatwg-urlencoded-separator (47381e2) with main (1e6ff97)}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}