Add referer dependent response check (#149)

[jthack]

Summary

• probe same-origin vs external Referer headers and compare responses
• raise medium finding when status or body length diverges beyond threshold
• register check in backend registry and expose toggle in Balanced active preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Referer dependent'

Closes #149