Default to & as separator instead of either & or ;

[mimosa]

Allowing ; as separator by default can lead to web cache poisoning.

Fixes #1732

[mimosa]

@rafaelfranca Hi, I need to patch on rack2 because I use Rails 6 in the production env and need to pass snyk's security check.

[jeremyevans]

I don't think we are planning to backport this change to Rack 2.2, due to the backwards compatibility issues. See #1732 and #1733.

[mimosa]

I don't think we are planning to backport this change to Rack 2.2, due to the backwards compatibility issues. See #1732 and #1733.

I understand that 2.2 is a maintained version and this pr is just a security patch, isn't that right?

[jeremyevans]

This isn't "just a security patch", it's also a backwards incompatible change that will break applications relying on the feature.

[mimosa]

Thanks @jeremyevans, I will reconsider the changes this fix brings to rack 2.2 and our project.