Add Aivist Verify to Authorization Testing

[Aivist]

This adds Aivist Verify to the Authorization Testing section, as suggested in #1. One line, following the existing numbered format.

The section already covers the observe-and-replay side well. Autorize and AuthMatrix let you see how responses differ across identities and roles, and then you judge the result yourself. Aivist Verify sits a step after that: you hand it a single candidate (one endpoint, two identities) and it adjudicates that candidate in code, returning either a confirmation with a replayable evidence chain or an honest "not confirmed". The model reads the traffic and proposes a verdict, but a deterministic gate re-checks that proposal against the attack's own bytes and can only ever downgrade it, so a confident-sounding model answer can't become a confirmation on its own.

It's a local CLI, MIT licensed, Python. I validated it against OWASP crAPI and VAmPI rather than only my own test targets, and those runs are archived verbatim in the repo. That includes one case where it produced a real false positive on crAPI's public community feed; it was fixed and re-verified against live crAPI, and the archive keeps both the original mistake and the fix. It also declines to confirm resources that every authenticated user can read, since black-box that's indistinguishable from a resource shared on purpose.

Happy to adjust the wording or drop it if it isn't a fit for the list.

Full disclosure: I'm the author.