Improve API HPP parser evidence

[DENGXUELIN]

Closes #1715.

Summary

• add HTTP Parameter Pollution and parser-consistency evidence gates to api-security
• add checklist guidance for duplicate query/form/header/body parameters across gateway, validator, handler, cache, signing, and downstream services
• add vulnerable and benign fixtures for tenant parser confusion versus duplicate parameter rejection

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• added-line ASCII check
• content marker check for API-HPP-* findings and fixtures
• git merge-tree --write-tree origin/main HEAD

Bounty

Requested tier: Improver Moderate, USD 100 if accepted.