Security suite switch: readers disagree on blank and non-'true' values #1845

What: the four readers of the security suite on/off keys treat some stored values differently. A blank feature.cerberus.enabled counts as 'no opinion' for the status page but as 'present and off' for the proxy and middleware, so status can show the suite on while the proxy is not enforcing. The CrowdSec presets gate alone accepts 1 and yes.
Where: backend/internal/api/handlers/security_handler.go (status), caddy/cerberus_decision.go, cerberus/cerberus.go, crowdsec_handler.go (isCerberusEnabled). Pinned by cerberus_reader_matrix_test.go and its golden file.
Evidence: the matrix golden file in PR #1844.
Severity: low. Suggested approach: decide one rule for blank and extra tokens, change the golden file deliberately, and note the upgrade effect (status may show off where it showed on).