Evaluate an API endpoint against OWASP API Top 10 controls (BOLA, BOPLA field allowlisting, rate limiting, and SSRF protection).