fix(http): bind every occurrence of a repeated query parameter

[juicycleff]

bindFormParam learned to fill a []string from a repeated parameter in
v1.1.7. bindQueryParam did not, and still reads one value through Query, so
a []string query field takes the first occurrence and drops the rest.

Why this is worse than the bug it replaced

Before setFieldValue grew a slice case, that same field failed the request
outright with "unsupported field type". Loud, and impossible to miss.

Now the lone value it does read gets split on commas instead, so the request
succeeds carrying less than the caller sent. For an RFC 8707 resource
indicator that means an access token scoped to fewer audiences than were asked
for, with nothing logged and nothing returned to say so. Silent narrowing of an
authorization boundary is the failure mode you least want.

Measured before the change:

binding path	resource=a&resource=b
bindFormParam	["a", "b"]
bindQueryParam	["a"]

What changed

The query path now mirrors the form path, the same branch in the same order:

• a repeated parameter is taken verbatim
• a lone value still expands on commas, the way scope=openid,profile always has
• an absent parameter still falls back to the default tag
• a required one still reports itself missing

Reusing isMultiValueTarget and setSliceFieldValue means the two paths cannot
drift apart on what counts as a slice target or how elements get converted.

Seven tests cover those cases, including the one that pins the asymmetry: a
lone scope=openid,email splits, while a repeated scope=openid&scope=a,b
keeps a,b whole. Both failed before the change for the repeated cases and
passed for the rest, so the existing behaviour is nailed down as well as the
new.

Not included

Header parameters have the same shape and the same gap. Repeated headers are
rarer and nothing is waiting on them, so bindHeaderParam is untouched here
rather than changed without a caller to justify it.

Downstream

authsome's OAuth2 authorization endpoint reads resource off the raw request
today, purely to work around this. Once this ships it becomes an ordinary
[]string field with a query tag, which also puts the parameter in the
generated OpenAPI document for the first time, and therefore in the generated
clients.

[github-actions]

🎉 This PR is included in version 1.1.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀