Stop treating query string octets like %ED %AC as failures

* Replace `CGI.escape` with `URI.encode_uri_form_component` in `QueryHash`,
  which can handle the `"\xED"` that `CGI.escape` would fall over on.
* Stop pretending that this is somehow what RFC3986 would have done because `CGI.escape`
  did it. We should be encoding, not escaping.
* This is a major version bump only because we previously specced the broken behaviour