Provide a way to gracefully and securely handle non-percent-encoded query string values

When the web server allows a non-RFC-compliant query string (i.e., one that includes non-ASCII byte values that were not percent-encoded) to be passed to the app, we should provide a way for the app to at least detect such values. We might also provide an option for automatically rejecting them or perhaps attempting to decode them as UTF8.

Should we also add support for automatically percent-encoding query params when using the `testing.simulate_*` methods?

Start by tracing the query-string handling path and the testing.simulate_* methods named in the issue. First resolve whether the scope is detection, rejection, UTF-8 decoding, simulator percent-encoding, or some combination; done means the chosen behavior is specified and covered by tests.

Written by the indexing model from the issue text.