Add API effective route evidence gates

[Peter7896]

Summary

• Upgrades api-security to v1.1.0 with effective method/path evidence gates for method override, gateway rewrites, path normalization, unsupported methods, and specification drift.
• Extends the API5/API8/API9 checklist with review steps for X-HTTP-Method-Override, _method, route rewrites, encoded slash handling, duplicate slashes, semicolon parameters, 405 Method Not Allowed, and OpenAPI method drift.
• Adds benign and vulnerable fixtures for normalized gateway/app routing, scoped legacy method override, method override bypass, proxy rewrite pre-authorization bypass, encoded slash route confusion, and OpenAPI method drift.

This expands coverage with fixture-backed gateway/application evidence and an explicit output table for effective method and route review.

Related issue

Closes #1283

Validation

• git diff --check
• git diff origin/main..HEAD --check
• Frontmatter required-field check for api-security/SKILL.md
• Markdown fence-balance check for api-security/**/*.md
• JSON parse check for added fixtures
• node --check for added JavaScript fixtures
• Prompt-injection pattern scan on added diff lines
• Public identity hygiene scan on added diff lines
• Keyword coverage check for Effective Method and Route Normalization Evidence, X-HTTP-Method-Override, _method, methodOverride, UseHttpMethodOverride, HiddenHttpMethodFilter, proxy_pass, encoded slash, duplicate slash, semicolon, 405 Method Not Allowed, OpenAPI, Not Evaluable, API5, API8, API9, and RFC 9110