FilterQueryString: fix sub-expression parsing

In a string like !(b=c)&a=d the parser used to fail once it reached
the &, fixed now.

library/Icinga/Data/Filter/FilterQueryString.php

@@ -93,7 +93,7 @@ class FilterQueryString
         ));
     }
 
-    protected function readFilters($nestingLevel = 0, $op = '&')
+    protected function readFilters($nestingLevel = 0, $op = null)
     {
         $filters = array();
         while ($this->pos < $this->length) {
@@ -113,6 +113,11 @@ class FilterQueryString
                     continue;
                 }
 
+                if ($op === null && count($filters > 0) && ($next === '&' || $next === '|')) {
+                    $op = $next;
+                    $next = $this->readChar();
+                }
+
                 if ($next === false) {
                     // Nothing more to read
                     break;