fix(http): distinguish repeated transfer cache params - #68571

This fix addresses ambiguous HttpTransferCache key generation for request parameters.

sortAndConcatParams() previously interpolated params.getAll(k) directly. Since getAll() returns an array, JavaScript string coercion joined repeated values with commas. This caused semantically different requests such as role=user,admin and role=user&role=admin to produce the same transfer-cache key material during SSR.

Changes:

• Serialize transfer-cache params as structured sorted key/value tuples instead of comma-joined strings.
• Deduplicate repeated URLSearchParams.keys() entries before reading getAll().
• Preserve the existing empty-params key material.
• Add a regression test showing scalar-comma params and repeated params no longer reuse the same cached response.

This change is prepared for a security report that follows the Google OSS VRP patch-first path for product vulnerabilities in OT0 projects.

Security impact:

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient
request receive the response from an earlier semantically different request in the same render. For
example, an attacker-influenced scalar-comma request can be cached and then replayed as the response
for a trusted repeated-param authorization/data request to the same URL. In that shape, Angular's
server-rendered output can be based on the wrong backend decision because the trusted request is not
dispatched.

PR Checklist

Please check if your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (not applicable; internal cache-key behavior)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• angular.dev application / infrastructure changes
• Other... Please describe:

What is the current behavior?

Issue Number: N/A

During SSR, HttpTransferCache can generate identical key material for distinct request params because repeated values are joined with commas:

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

Both requests previously serialized as role=user,admin, allowing the second request to receive the first cached response.

What is the new behavior?

Transfer-cache params are serialized as structured key/value tuples. Repeated params and scalar comma params now produce distinct cache keys, so the repeated-param request reaches the backend once and then reuses only its own cache entry.

Does this PR introduce a breaking change?

• Yes
• No

Other information

Local validation:

bazelisk test //packages/common/http/test:test --test_filter='TransferCache withHttpTransferCache should differentiate repeated parameters from scalar comma parameters'
bazelisk test //packages/common/http/test:test

Both tests passed locally.