fix: parse JSON string where query param (#15745)

### What?

Support `where` sent as a JSON string in REST API requests (e.g.
`?where={"read":{"equals":false}}`). Previously the filter was silently
ignored; now it's parsed correctly.

### Why?

GET query params are always strings. `parseParams` parsed `data` this
way already but skipped `where`, so string-encoded filters had no
effect.

### How?

After the `data` block in `parseParams`: if `where` is a non-empty
string, `JSON.parse` it. If it's already an object (e.g. from bracket
notation), leave it alone.

---------

Co-authored-by: Patrik Kozak <35232443+PatrikKozak@users.noreply.github.com>