claude-in-chrome: output sanitizer blocks URLs with two query params

The javascript_tool output sanitizer blocks any string with = AND (; OR &), labeling it [BLOCKED: Cookie/query string data]. False-positives on every signed URL (S3/CloudFront/Skool/etc.) since ?a=1&b=2 matches.

Source: ~/Library/Application Support/Google/Chrome/Default/Extensions/<id>/<ver>/assets/mcpPermissions-*.js

if (e.includes("=") && (e.includes(";") || e.includes("&")))
  return "[BLOCKED: Cookie/query string data]";

Cookies are ;-separated and lack a scheme; URLs start with http(s)://. The rule should distinguish them.

Breaks the common pattern of returning a signed asset URL out of Chrome to curl from the shell.