Add CORS null-origin and PNA evidence gates

[bozicovichsantiago20-oss]

Summary

• Adds API8 evidence gates for exact CORS allowlist reflection versus arbitrary origin reflection.
• Covers credentialed Origin: null / opaque-origin rejection and Private Network Access trusted-origin handling.
• Extends report evidence fields, review checklist, false-positive guardrails, references, and version history for �pi-security v1.0.1.

Validation

• git diff --check (only existing Windows LF-to-CRLF warning)
• Markdown fence balance check for SKILL.md and �pi-top10-checklist.md
• Marker checks for Origin: null, Private Network Access, Access-Control-Allow-Private-Network, Vary: Origin, CORS/PNA Evidence, and version 1.0.1
• Reference URL checks returned HTTP 200 for MDN CORS, MDN Access-Control-Allow-Origin, and WICG Private Network Access

Closes #1202

Bounty request: Skill Review () for #1202 and Improver Moderate () for this PR if accepted. Payment details can be provided privately after maintainer acceptance.