There are several & characters in the string, so they are being parsed as separate parameters. If you can't change the way the external app encodes the string, you'll have to get the separate parameters and rebuild the string.
String report = RestContext.request.params.get('report');
String param1 = RestContext.request.params.get('_nc_oc');
This is 3 years late, but if anyone ever sees this, you can also use responseString = response.getBody() and make a string of the response, then use responseString.Replace('"reservedWord":', '"yourNewWord":') to map response fields to a wrapper class.
You declare demoGoods locally, then you assign it and return it. But you never touch the RestContext.response in order to set it there. Your test expects you to do so.
DemoGoods = Database.query(qryString);
// here you need to set RestContext.response.responseBody
Most likely, you will just serialize your records.