[Auth] Unauthenticated endpoint detection

[emmanuelgautier]

Description

Detect endpoints that should require authentication/authorization but don't, using single-token or credential-free probes.

Checks to implement

• Endpoint responds 200 without credentials
• Missing login lockout / no HTTP 429 on burst
• Scope / role claim absent but accepted
• JWT aud not validated (single-token probe)

Tier rationale

Detectable with one identity (or none) — no cross-user comparison involved.

Output contract

Every finding must emit: CWE ID, CVSS v4.0 score, OWASP API Top 10 category, remediation link, and a proof-of-concept request/response pair.