API doesn't handle URI-escaped characters in parameters

[bwarden]

Trying to retrieve both OLSR status and active AREDN alert messages, for example, the following query is ok:

$ GET 'http://localnode/cgi-bin/api?status=olsr,alerts'

{
  "pages": {
    "status": {
      "alerts": {
        "aredn": "",
        "local": ""
      },
      "olsr": {
        "nodes": "356",
        "entries": "1258"
      }
    }
  },
  "api_version": "1.5"
}

However, if I wrap this up nicely from some other program (like Home Assistant, for example), it might helpfully URI-encode the comma, confusing the API:

$ GET 'http://localnode/cgi-bin/api?status=olsr%2Calerts'

{
  "pages": {
    "status": [
    ]
  },
  "api_version": "1.5"
}

The underlying issue is that parseQueryString() simplistically splits on & and =. Fortunately, we already have luci.http.urldecode_params() available, so we should use that instead.