[Config] Cookie & HTTP hygiene

[emmanuelgautier]

Description

General HTTP/cookie hygiene and information-disclosure checks.

Checks to implement

• Cookie missing HttpOnly / Secure / SameSite
• HTTP TRACE / TRACK enabled
• HTTP method override header accepted
• Server / X-Powered-By banner leak
• Verbose errors / stack traces
• Directory listing enabled

Tier rationale

All deterministic from a single unauthenticated (or single-identity) request.