Fix params, empty cookies, multiple_domains, per-request timeout and https-only proxies

[FlorianREGAZ]

Removes the last five xfail markers.

• params on a URL with a query string: ?page=2 plus params={"q": "x"} now gives ?page=2&q=x instead of ?page=2?q=x. The params go before a fragment, and empty params leave the URL as it is (before, params={} added a bare ?).
• session.params is sent with every request. A request param replaces the session param of the same name.
• Empty cookie values: jar["consent"] returns "" instead of raising KeyError. Two matching cookies with empty values now raise CookieConflictError, as two non-empty ones already did.
• multiple_domains() returns True when the jar has two distinct domains. Before, it returned True only for a repeated domain.
• Per-request timeout / insecure_skip_verify: the library fixes both when a native session sends its first request. Each combination of the two now gets its own native session, with an ID built from the session ID and the two values. close() destroys all of them and returns the library's reply for the last one. The tradeoff is that requests with different settings don't share connections. A new integration test covers insecure_skip_verify in both directions.
• Proxy dict with only "https": now used. When both entries are set, "http" still wins for every URL, as before.

Not changed: cookies passed to a single request are still added to the session jar, as decided in #160. Session attributes changed after the first request (for example force_http1 or the TLS settings) still keep their first value in the native session, the same way the timeout used to.

uv run pytest: 478 passed. Ruff and mypy are clean. Without the sessions.py change, the three integration tests for the first-request settings fail.

🤖 Generated with Claude Code