OutputBuilderOnlyParam

Excluded rather than an allow-list of what to print. This format exists to feed parameter fuzzers, so the question is which inputs aren't wanted: headers and cookies have their own -f only-header / -f only-cookie, and a path param is a URL segment rather than a parameter to submit.

It used to be the other way round — an allow-list of six types — and every type outside it was silently dropped: multipart file fields, an xml request body, Android intent extras. That is the same failure the body alias fix hit, one layer up, and a deny-list means a param type a new analyzer introduces shows up here by default instead of vanishing.