[Bug] TG-CACHE-001 flags caching risks when middleware is commented out without header verification

[githubmofo]

🐛 What is the bug?

During local validation on NodeGoat, rule TG-CACHE-001 flagged sensitive response caching solely because helmet.noCache() was commented out in server.js. However, in some frameworks, default framework settings or reverse proxies (like Nginx/Cloudflare) already inject Cache-Control: no-store.

🎯 Expected Behavior

The rule should instruct the agent to verify actual HTTP response headers or upstream reverse proxy configuration before marking TG-CACHE-001 as a confirmed vulnerability.

💡 Suggested Fix

Update the detection guidance in rules/cache/TG-CACHE-001-sensitive-response-publicly-cacheable.md to classify commented middleware as Likely or Manual Review rather than Confirmed.