[BUG] CollapseSlashesFilter drops query string and fragment when collapsing path

- Severity: High
- Location:
`shenyu-web/src/main/java/org/apache/shenyu/web/filter/CollapseSlashesFilter.java:36-38`
-
Description:
The filter computes `newPath = request.getURI().getRawPath().replaceAll("/{2,}", "/")` (path-only string, no query/fragment), then calls `request.getURI().resolve(newPath)`. Per `java.net.URI` resolution semantics, resolving a relative reference with only a path component **replaces** the query and fragment of the base URI with null. E.g. `URI.create("http://h/a//b?q=1#f").resolve("/a/b")` produces `http://h/a/b` — query and fragment silently lost.
-
Impact:
When `collapseSlashes=true`, any request with double-slashes in the path AND a query string loses all query parameters. Breaks pagination, search, API key passing, query-param-dependent routing.
-
Suggested fix:
Reconstruct the URI preserving query/fragment: `UriComponentsBuilder.fromUri(request.getURI()).replacePath(newPath).build().toUri()`.
-
Confidence: High
- Related existing: PERF-03 covers regex recompilation perf in the same filter, not the query-loss functional bug.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Start in shenyu-web/src/main/java/org/apache/shenyu/web/filter/CollapseSlashesFilter.java at lines 36-38 and reproduce the URI example with a double-slash path, query, and fragment. Confirm the collapsed path retains the query and fragment, then verify requests with query-dependent routing no longer lose those components.

Written by the indexing model from the issue text.