New Rule: PII in Response (OWASP API3)

[philsturgeon]

User Story Description

As an API governance team
I want to detect PII in the response
So I can justify its use, or remove it.

Acceptance Criteria

• Has a decent list of PII fields, not all encompassing but something to get this started
• Checks responses and schemas whether inline or $ref.
• Warning

More Information: https://apisecurity.io/encyclopedia/content/owasp/api3-excessive-data-exposure

Identify all the sensitive data or Personally Identifiable Information (PII), and justify its use.