Add agent-driven SSRF replay and async authorization drift risks

[balaakasam]

This PR introduces two emerging architectural risk patterns observed in agent-driven systems:

• Agent-driven replay & rebinding SSRF where stored URLs become exploitable over time.
• Asynchronous authorization drift where background agents mutate protected fields post-validation.

These additions extend API7 (SSRF) and API6 (unrestricted-access-to-sensitive-business-flows) with modern agentic abuse cases.

[balaakasam]

Thank you for reviewing my contribution. This update documents a new architectural risk pattern observed in modern agentic
systems, where autonomous workflows unintentionally retain stale or over-privileged OAuth scopes across task boundaries, enabling SSRF-style exploitation paths that are not explicitly covered today.
I would appreciate any maintainer feedback and I’m happy to refine the content to better align with existing guidance or project standards.

[ErezYalon]

Tagging this as pending community feedback. Same category as #145/#146 — this introduces new "Agentic System Risk" content, which needs broader discussion before merging. Keeping this open as a candidate for the next version.