Implement security_gate(handlers) — stricter cousin of the practice audit:
- each handler: {'name', 'checks': set, 'public': bool} where 'public' marks endpoints intentionally unauthenticated (health checks)
- an endpoint that is NOT public must have 'auth' AND 'owner' (data endpoints) — missing either → vulnerable with 'critical': True
- an endpoint that IS public but has any of 'auth'/'owner' checks is suspicious (flag 'suspicious': True — why would a health check need auth code?)
- missing 'params' or 'encode' → vulnerable (not critical)
- return {'clean': [...], 'vulnerable': [...worst-first, ties by name...]} where vulnerable entries carry 'missing' (sorted), and 'critical'/'suspicious' booleans only when True
Difficulty: advanced