- Add severity levels to all rules
- Add new rules: Cross-Origin-Resource-Policy, Permissions-Policy, X-Permitted-Cross-Domain-Policies
- Add SameSite to Set-Cookie must-contain list
- Demote Pragma from Required to Optional
- Add Permissions-Policy delimiter config
- Update tests and test resources to match

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>