feat(set-cookie): analyze Set-Cookie attributes (Secure/HttpOnly/SameSite)

[dmchaledev]

Summary

rules.ts checked 7 header categories but never inspected Set-Cookie — a site could score A+ while shipping a session cookie with none of Secure, HttpOnly, or SameSite set (readable by any injected script, replayable over plain HTTP, and CSRF-exposed). Every comparable tool (securityheaders.com, Mozilla HTTP Observatory) checks this. See #95 for the full writeup.

• Add checkSetCookie (src/rules.ts, 10 points): flags cookies missing Secure/HttpOnly/a restrictive SameSite, and flags SameSite=None without Secure as an invalid/broken combination the browser will reject. No Set-Cookie header at all is treated as N/A (status: 'good', full credit) rather than penalized — not every response sets cookies.
• Wire it into analyzeHeaders (src/analyzer.ts); grading stays percentage-based so no rebalancing of existing weights was needed.
• Fix a related bug in fetchHeadersWithMeta (src/fetch.ts): res.headers.forEach emits one set-cookie entry per cookie (confirmed via a quick Node repro), and the code was assigning each into a flat Record<string, string>, silently keeping only the last cookie. Now collects all values via getSetCookie() and joins them with \n (safe against commas inside Expires=...), so multi-cookie responses are each evaluated.
• Updated README ("What it does" summary + Headers Checked table) and tests (maxScore 100 → 110, the "empty headers" test, new checkSetCookie unit tests, and a fetchHeaders test for multi-cookie preservation).

Closes #95.

Test plan

• npm run typecheck
• npm run build
• npm test — 150 passing (7 new: 6 checkSetCookie cases + 1 multi-cookie fetch case)

---

Generated by Claude Code