fix($location): parse query parameters which precede hash in hashbang mode

This fix causes `LocationHashbangUrl#$$rewrite()` to move a pre-hash query
string to after the hash.

This, in turn, causes urlResolve() to correctly parse the query string, and 
report the correct dictionary.

Closes #7239