Add password returned in URL check (#141)

[jthack]

Summary

• scan response bodies and Location headers for URLs carrying password-like query parameters
• raise a high-severity finding listing affected parameter names and lengths
• register the passive rule and enable it for the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Password returned in URL'

Closes #141