Fix unexpected query parameters in adapter deployments - #98584

The Vercel adapter enables `passQuery: true`, which forwards named route
captures to prerender functions as query parameters instead of using the
legacy route-matches header. When a request bypasses prerendered output,
this also exposes internal path-building captures through application
`searchParams`. With `experimental.collapseAdapterRoutes` disabled, RSC
renders can receive `rscSuffix=.rsc`. With the flag enabled, document
and Server Action renders can also receive `rscSuffix=`, and collapsed
fallback shells can expose values such as `shellPrefix=en`. These
additions can overwrite user query parameters and cause unnecessary
navigation retries.

When using an adapter, we now emit unnamed captures for these path-only
values. For example, `(?<shellPrefix>de|en)` and its destination
reference `$shellPrefix` become `(de|en)` and `$1` when no locale
capture precedes the group. Likewise, `(?<rscSuffix>...)` and
`$rscSuffix` become `(...)` and a positional reference such as `$2` when
one capture precedes the suffix. The generator accounts for parameter
and locale captures and escapes literal base paths. Destination
substitution runs once, preserving captured text and correctly
distinguishing references such as `$1` and `$10`.

Cache-bypass rules, route counts, and route ordering remain unchanged.
User-supplied `rscSuffix` and `shellPrefix` remain valid query
parameters. Standard `next dev` and `next start` routing, and Vercel's
legacy deployment path, do not use these generated adapter routes.