fix(permissions-policy): recognize any non-wildcard directive value as restrictive

[dmchaledev]

Bug

checkPermissionsPolicy used literal string matching to detect whether a feature was restricted:

const hasCam = lc.includes("camera=()");
const hasMic = lc.includes("microphone=()");
const hasGeo = lc.includes("geolocation=()");

This only matched the deny-all form =(). Any other valid restrictive value — camera=(self), camera=(https://trusted.example.com) — caused a false-positive warning and dropped the score from 10 to 5, with the misleading message "Permissions-Policy does not restrict at least camera, microphone, and geolocation" even though the policy does restrict all three.

Real-world policies commonly use =(self) to allow camera/microphone on the same origin while blocking third-party iframes. These were incorrectly penalised.

Fix

Added isPermissionsPolicyFeatureRestricted(policy, feature) which parses the directive properly:

• feature=() → restricted (deny all)
• feature=(self) → restricted (allow same-origin)
• feature=(https://example.com) → restricted (specific allowlist)
• feature=* → not restricted (wildcard, allow all origins)
• directive absent → not restricted

The helper also guards against partial suffix matches (e.g. notcamera=() should not satisfy the camera check).

Tests

Four new test cases added to analyzer.test.ts:

Case	Expected
camera=(self), microphone=(self), geolocation=()	score 10, good
camera=(https://example.com), microphone=(), geolocation=()	score 10, good
camera=*, microphone=(), geolocation=()	score 5, warning
notcamera=(), microphone=(), geolocation=()	score 5, warning

All 89 tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_011rKFKyLpkTsT5DeJi8yw8U

---

Generated by Claude Code