When hide_credentials=true, query parameters should not be sorted
alphabetically. This alters the original request and can have unintended
consequences for upstream services. One example is authentication with
the pseudo header (request-target) as described in
https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures#section-2.3.
Since the order is not preserved, the signature does not match and the
upstream rejects the request.

* query parameters order is not altered when hide_credentials=true
* add two new test cases in spec/03-plugins/09-key-auth

Error handling on nginx_re_gsub.