l12-mixed-content-asset

Same detection surface as l1-mixed-content — an http:// image loaded on an HTTPS page. Filed as L12 because the risk shape is the security-model bypass, not the transport gap. One check catches both; the manifest maps both defects to L1.MIXED_CONTENT.