feat: support HTTP QUERY method (RFC 10008)

[mcollina]

Description

Adds support for the HTTP QUERY method standardized in RFC 10008 (June 2026), enabling safe/idempotent requests with bodies.

Changes

• lib/core/util.js: Added QUERY to normalized method records and safeHTTPMethods
• lib/core/request.js: QUERY is idempotent by default (safe to retry)
• lib/handler/redirect-handler.js: Comment clarifying QUERY is safe (like GET) and won't change method on 301/302 redirects
• lib/handler/retry-handler.js: QUERY added to default retryable methods
• lib/web/fetch/constants.js: QUERY added to safeMethods for the Fetch API

Closes #5454

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.47%. Comparing base (0f1f890) to head (83cfccc).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5459   +/-   ##
=======================================
  Coverage   93.46%   93.47%           
=======================================
  Files         110      110           
  Lines       37106    37118   +12     
=======================================
+ Hits        34682    34696   +14     
+ Misses       2424     2422    -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jeswr]

One correctness note before this lands: adding QUERY to safeHTTPMethods also lets it into the cache/deduplicate interceptors' methods, but their keys ignore the request body. A QUERY's response depends on its body (RFC 10008 §2.7), so cache({ methods: ['GET','QUERY'] }) / deduplicate({ methods: ['QUERY'] }) could serve the wrong response for a different body. As this is opt-in only (default ['GET']), nothing breaks by default — but might be worth excluding QUERY there, or making the key body-aware. Redirects/retry/preflight look correct.

I'm creating issues/PRs for improved retries and caching on my fork (GenAI-assisted), I am happy to upstream those issues/PRs once I have reviewed them.