Fix get_path_param_names to strip path converters

The regex {(.*?)} captures 'param:path' instead of 'param' when path
converters are used. This causes implicit path params to be incorrectly
treated as query params.

Fix: use {([^:}]+)} to stop at the colon separator.

Fixes #14883

fastapi/utils.py

@@ -41,7 +41,7 @@ def is_body_allowed_for_status_code(status_code: int | str | None) -> bool:
 
 
 def get_path_param_names(path: str) -> set[str]:
-    return set(re.findall("{(.*?)}", path))
+    return set(re.findall("{([^:}]+)", path))
 
 
 _invalid_args_message = (