#35964 fuzz: add coverage for GetQueryParameterFromUri

• Fuzz test untrusted query string parsing on the REST interface
• Catches edge-case parser bugs with duplicate keys and fragment delimiters

This pull request adds a new fuzz target `http_query_parameter` to test `GetQueryParameterFromUri()`. In addition to fuzzing arbitrary input, it asserts proper handling of URL-encoded query parameters, duplicate keys, missing values, and URI fragment delimiters.

Problem: `GetQueryParameterFromUri()` parses untrusted query strings from remote clients on the REST interface, but it lacked dedicated fuzz coverage for edge cases like duplicate keys or URI fragments.

P3 · test coverage

• P3 because it expands fuzz coverage for remote input parsing on REST endpoints
• Exercises parser boundaries and URL-encoding invariants without architectural changes

Worthwhile test coverage expansion. The parser handles remote input on REST endpoints, and the new fuzz harness exercises parser boundaries and URL encoding invariants without needing deeper architectural changes.

Membership: Adds a new fuzz target under src/test/fuzz/http_request.cpp.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 0

• Ready for review
• Small patch with prior reviewer feedback already incorporated

The patch is small, cleanly rebased, and reviewer suggestions have already been incorporated.

Author status: Active, addressed reviewer suggestions in a force-push on 2026-08-15.

Resolved concerns:

• nervana21 pointed out that checking key precedence before and after `#` needed a test where the key only appears after the fragment separator; the author updated the test accordingly.

• Strong support after author addressed suggested edge cases (nervana21)
• Verified by testing (nervana21)

Strong support with tACK after addressing review feedback (nervana21)

nervana21 reviewed and provided detailed suggestions for edge-case coverage, which the author adopted, leading to a tested ACK.

• nervana21 gave Concept ACK and suggested asserting that keys appearing only after `#` are ignored
• laxmanacharya8 force-pushed to include the suggestion
• nervana21 left a tACK on the updated commit

Review verdicts (DrahtBot): 1

• ACK: nervana21

27 lines under test/bench/ci.

• src/test/fuzz/http_request.cpp +27/-0

PR #35964 introduces a new fuzz harness `http_query_parameter` to test URI query string parsing for the REST interface. It exercises arbitrary inputs and asserts correct handling of edge cases like missing values, repeated keys, and URI fragment separators. The change expands test coverage over code that parses remote user input, addressing an uncovered parser path. Review is in a strong state with a tested ACK from nervana21 following author updates to test logic.