Add CORS null-origin and PNA evidence gates

[z707693052]

Closes #1202

Summary

• Add API8 CORS misconfiguration examples for arbitrary origin reflection and Private Network Access preflight exposure.
• Require evidence for exact-origin matching, null/opaque origin rejection, Vary: Origin, PNA allow decisions, and per-endpoint preflight method/header restrictions.
• Keep the guidance focused on API review false positives: exact dynamic allowlists are acceptable when properly scoped and cache-safe.

Validation

• git diff --check
• Markdown fence balance check for skills/appsec/api-security/api-top10-checklist.md
• Marker checks for PNA, Origin: null, and Vary: Origin