Add password-in-cookie check (#143)

[jthack]

Summary

• parse Set-Cookie headers and flag password-like names or values
• report a high severity finding while redacting actual secret material
• register the passive check and enable it in the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Password value stored in cookie'

Closes #143