Add web export and download evidence gates

[Peter7896]

Summary

• Upgrades owasp-top-10-web to v1.1.0 with CSV/spreadsheet export and download response evidence gates for formula neutralization, Content-Disposition filename safety, browser handling headers, sensitive cache controls, and access/audit evidence.
• Extends A03/A05 CWE mapping, grep hints, severity guidance, false-positive and Not Evaluable rules, and the output template with an export/download evidence table.
• Adds benign and vulnerable fixtures for safe CSV output, public cached downloads, raw formula exports, unsafe Content-Disposition filename reflection, and sensitive inline cached exports.

This expands coverage with fixture-backed evidence and explicit reviewer output for export/download paths.

Related issue

Closes #1286

Validation

• git diff --check
• git diff origin/main..HEAD --check
• Frontmatter required-field check for owasp-top-10-web/SKILL.md
• Markdown fence-balance check for owasp-top-10-web/**/*.md
• node --check for added JavaScript fixtures
• Prompt-injection pattern scan on added diff lines
• Public identity hygiene scan on added diff lines
• Keyword coverage check for CSV, formula, Content-Disposition, filename*, CR/LF, RFC 6266, nosniff, no-store, Cache-Control, Not Evaluable, CWE-113, and CWE-1236