Add request URL override detection (#150)

[jthack]

Summary

• flag responses that reveal URL override headers (X-Original-URL, X-Rewrite-URL, X-Forwarded-URL)
• report medium severity since proxies honouring these headers enable routing bypasses
• register the passive check and enable it in the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Request URL override'

Closes #150