[@polka/url] Incorrect query params parsing when param contains encoded "&"

Nobody has claimed this yet.

Consider the url below:

```
/?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeVTXPUF4Oz4%26list%3DPLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6"
```

`@polka/url` parse the above into:

```
{
url: 'https://www.youtube.com/watch?v=eVTXPUF4Oz4',
list: 'PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6'
}
```

which is incorrect.

## Reproduction

```js
const parser = require("@polka/url");
const querystring = require("querystring");

const url = `/?url=${encodeURIComponent(
"https://www.youtube.com/watch?v=eVTXPUF4Oz4&list=PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6"
)}`;

console.log(parser({ url }, true)?.query);
// {
// url: 'https://www.youtube.com/watch?v=eVTXPUF4Oz4',
// list: 'PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6'
// }

const queryparamsstr = url.substring(url.indexOf("?") + 1);
console.log(querystring.parse(queryparamsstr));
// [Object: null prototype] {
// url: 'https://www.youtube.com/watch?v=eVTXPUF4Oz4&list=PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK'
// }
```

Start with the @polka/url parser shown in the reproduction and run the provided JavaScript case alongside querystring.parse for comparison. The issue is done when an encoded ampersand remains part of the url parameter value instead of creating a separate list parameter.

Written by the indexing model from the issue text.