apply_modifications rebuilt the request URL with parse_qs, which drops
blank-valued query params such as "state=" and collapses repeated keys
to only their first value. When repeat_request applied a params override,
it silently changed parts of the request the caller never asked to touch,
which breaks faithful replay for parameter tampering and injection tests.
Rebuild the query with parse_qsl and keep_blank_values=True so every
existing param, including empty and repeated ones, is carried through
unchanged while the requested params are added or updated.
