Add reflected input check (#110)

[jthack]

Summary

• reuse parameter extraction helpers to detect reflected query/body values
• report low-severity finding listing the reflected parameter names and value lengths
• register the passive check and enable it in the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Input reflected'

Closes #110