querystring: fix value decoding after encoded keys

[vedchaudhari]

When querystring.parse() uses the general parse path, a key with more than one percent escape can corrupt non-ASCII characters in the value:

const qs = require('node:querystring');
qs.parse('%C3%A4=caf\u00e9%', null, null);
// before: [Object: null prototype] { 'ä': 'caf�%' }
// after:  [Object: null prototype] { 'ä': 'café%' }

After the first escape, the remaining key characters fall through to the value's %XX check and set valEncoded. Moving the continue to the end of the key block fixes this.

Plain qs.parse(s) uses the fast path from #66175 and is not affected, but qs.parse(s, null, null) is, so the two return different results on main.

Added a regression test; querystring/url tests and make lint-js pass.

Refs: #66175

Assisted-by: Claude Code (Claude Opus 5.5)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.40%. Comparing base (fcfb7ec) to head (1c092ad).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66553      +/-   ##
==========================================
- Coverage   90.40%   90.40%   -0.01%     
==========================================
  Files         791      791              
  Lines      276226   276227       +1     
  Branches    53045    53044       -1     
==========================================
- Hits       249732   249731       -1     
- Misses      16899    16903       +4     
+ Partials     9595     9593       -2     

Files with missing lines	Coverage Δ
lib/querystring.js	100.00% <100.00%> (ø)

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.