Feat/command injection

[HC-ONLINE]

Description
Adds OS Command Injection detection (command_injection attack module) to the attack suite, wired through the entire stack (config, service, CLI, API, export), plus fixes discovered during live testing against DVWA.
New capabilities:

• CommandInjectionAttacker (src/ciberwebscan/core/attacks/command_injection.py): tests GET URL parameters, POST form fields, and POST/JSON request bodies (--json-body) with per-parameter payloads.
• Detection heuristics: unique echo markers (cmdi), OS error patterns (Windows/Linux/Unix), time-based injection (delay thresholds ≥2s/≥4s), status-code and response-length changes. Severity mapping: HIGH→CRITICAL, MEDIUM→HIGH, LOW→MEDIUM (CWE-78, OWASP A03:2021).
• Payloads: command_injection low/medium/high in attack_payloads.json with payloads.py fallback.
  Wiring:
• Config: attack.command_injection (default true) + AttackConfig.json_body in base.py.
• Service: AttackOptions.command_injection/json_body, _execute_command_injection_attack, command_injection_findings in results.
• CLI: --command-injection, --json-body; API: request model field + route wiring; exporters: JSON/JSONL/CSV/HTML.
  Bugs found during live testing vs DVWA and fixed:
• base.py: pass params=None instead of {} — httpx was dropping the URL query string (e.g. ?cmd=ver).
• sqli.py: added canonical MySQL/MariaDB error patterns (error in your SQL syntax, right syntax to use near) and preserve original query params when injecting.
• command_injection.py: preserve original query params on GET injection and include static form fields (Submit, hidden CSRF tokens) in POST form fuzzing.
  Tests & docs: 22 unit tests for the module, 3 regression tests for the base.py fix (fake client), updated mutation test; docs updated (AGENTS.md, API.md, CLI.md, CONFIGURATION.md, README.md, pentest.yaml profile).
  Related Issue
  N/A — no related issue.
  Type of Change
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
  Checklist
• I have followed the style guidelines of this project (Ruff & Pyright)
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes (433 passed, 1 skipped)
• I have updated the documentation accordingly
  Screenshots (if applicable)
  N/A — validation done via live tests against DVWA (authorized local target): 7 SQLi, 15 XSS, 5 cmdi, 20 traversal, 1 CSRF, 6 enumeration findings detected with correct confidence/severity.