Add mixed content detector (#132)

[jthack]

Summary

• only evaluate HTTPS responses and search for http:// references in HTML/CSS
• raise medium severity findings for each insecure attribute or CSS url()
• register the passive check and enable it in the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'Mixed content'

Closes #132