fix: interpolate variables in pre-serialized form-urlencoded string bodies

[MartinYanickGuillemette]

Problem

Variables in application/x-www-form-urlencoded request bodies are not interpolated — the literal {{variable}} text (percent-encoded as %7B%7Bvariable%7D%7D) is sent to the server.

Fixes #73

Reproduction

1. Create a request with a form-urlencoded body containing {{anyVariable}} (environment var, runtime var, {{process.env.X}}, or even a plain collection var)
2. Send it from the VS Code extension
3. The server receives the literal {{anyVariable}} string

Verified with a local echo server: the extension (bruno-runtime/1.0) sends client_secret={{ClientSecret}} literally, while the desktop app (bruno-runtime/3.5.3) interpolates correctly. Real-world impact: Azure AD OAuth2 token requests fail with AADSTS7000215: Invalid client secret provided.

Root cause

The send-http-request handler serializes form-urlencoded bodies to a string (qs.stringify / buildFormUrlEncodedPayload) before script execution, for @usebruno/js BrunoRequest compatibility.

By the time executeRequest calls interpolateVars, the form body is a string — but the form-urlencoded branch in interpolate-vars.ts only handles array data:

} else if (contentType === 'application/x-www-form-urlencoded') {
  if (request.data && Array.isArray(request.data)) { ... } // string bodies fall through
}

So the stringified body passes through uninterpolated.

Fix

When the form-urlencoded body is a string containing {{ or %7B%7B (braces are percent-encoded by qs.stringify), parse it with URLSearchParams, interpolate each name/value pair, and re-serialize. Bodies without variable placeholders are left untouched.

Testing

• Added interpolate-vars.spec.ts with 5 tests: array bodies, pre-serialized string bodies (encoded + unencoded braces), process.env variables, and passthrough of bodies without variables
• Full unit suite passes (84/84)
• node esbuild.extension.mjs build succeeds
• Manually verified against a local echo server and a real Azure AD token endpoint: the interpolated secret is now sent and the token request succeeds