querystring: validate surrogate pairs in encodeStr

[deepview-autofix]

The surrogate pair path in encodeStr only checked that a second code unit existed; it did not verify that the leading unit was a high surrogate (0xD800-0xDBFF) or that the trailing unit was a low surrogate (0xDC00-0xDFFF). A lone high surrogate followed by a non-surrogate (or a lone low surrogate) was silently combined and emitted as a syntactically valid four-byte UTF-8 sequence representing an entirely different code point, producing malformed output that does not roundtrip through querystring.parse.

Match encodeURIComponent semantics by throwing ERR_INVALID_URI when either half of the pair is not a valid surrogate.

Fixes: #62814

[ChALkeR]

This is mine (code scanner + autofix)

[ChALkeR]

Note that this assertion is changed to throw, how encodeURIComponent behaves.

[ChALkeR]

It was introduced in #12163 and was just increasing coverage / documenting behavior, not by design likely.

[gurgunday]

lgtm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.63%. Comparing base (14e16db) to head (b769d28).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #62834   +/-   ##
=======================================
  Coverage   89.62%   89.63%           
=======================================
  Files         706      706           
  Lines      219136   219138    +2     
  Branches    41987    41991    +4     
=======================================
+ Hits       196404   196421   +17     
+ Misses      14611    14608    -3     
+ Partials     8121     8109   -12     

Files with missing lines	Coverage Δ
lib/internal/querystring.js	100.00% <100.00%> (ø)

... and 25 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/72792/

[ChALkeR]

cc @nodejs/tsc as a safety measure

While I think this is more of a fix than a semver-major, others might have different opinion/reasons

Reasons for this being a fix:

1. that already threw on lone surrogates, just missed some cases
2. the intent was clearly to protect against invalid input
3. the new behavior better matches encodeURIComponent
4. could have security impact on users code in some setups (even though does not count as a security fix)

Reasons for this being a major:

1. A change in a stable and widely-used API that makes more invalid input throw
2. A change in the test expectations (even though I believe those test expectations were not designed, see above)

[mcollina]

lgtm