You were close to the solution. You need to get rid of the original query string thanks to the QSD
flag (supported in Apache httpd 2.4.0 and later versions).
So, to achieve your goal, you could use these Apache httpd directives:
# Tested with Apache 2.4.38
RewriteCond %{QUERY_STRING} ^url=(.*)
RewriteRule ^ %1 [QSD,NE,R=301,L]
Interestingly, this solution supports URLs that have a query string themselves, e.g., http://example.com/?url=http://domain.test/?lang=en
.
To deal with URLs that are passed encoded, like this: http://example.com/?url=http%3A%2F%2Fdomain.test%2F%3Flang%3Den
, the simplest method is probably to process the passed URL with a tiny script of this kind:
<?php
# WARNING: Add some security checks to prevent exploits like https://www.securityfocus.com/bid/55297/exploit
header('Location: '.$_GET['url']); # $_GET members are automatically passed through urldecode().
?>
If you choose to use this script, then the Apache httpd directives above become useless and must be removed.
Last but not least, you should be aware that this redirection methods represent a security/reputation risk as discussed here.