Inspect one bounded public HTTP response for cache directives, CORS headers, and redacted cookie security attributes.