Security audit: a cover group holding a garage door isn't flagged when exposed to a voice assistant #793

Found in review of #792 (the #773 fix).

What happens

The network security audit flags a door/gate/garage cover exposed to a voice assistant without a PIN (exposed_sensitive_entities, rule ha_sensitive_entity_exposed_without_pin). is_sensitive_entity (snapshot/network.py) decides what counts, by the cover's device class or a door/gate/garage word in its id or friendly name. A cover group holding the garage door, such as cover.all_covers ("All Covers"), has neither, so exposing it to Alexa or Google is not flagged. A mixed cover group has no device class, so Google's secure-device PIN does not apply to it either. Opening that group opens the garage door.

is_sensitive_entity says it mirrors the Critical Action PIN matcher; after #792 the matcher follows group membership and the audit does not.

Expected

An exposed group (cover group, MQTT/ZHA group, old-style group, at any depth) holding a sensitive cover is reported like the cover itself.

How

Reuse agent/rule_entities.py's group index (members from state, group_entities or the group helper's config entry) when collecting exposed, and update the "mirroring" docstring.