Enhance bypass techniques: Port bash payloads, expand headers, and add UA rotation

[Aceproulx]

Summary

This PR significantly enhances the 403 bypass techniques of the extension by porting missing logic from popular bash scripts, expanding the payload lists, and adding evasion capabilities.

Changes

1. Ported Bash Script Logic:
   • Added 15 specific URL path mutation variants directly into the code (e.g., /%2e/path, //path//, extension appends like .json, and suffix characters like ..;/).
   • Added a dedicated TRACE method test.
2. Expanded Header Payloads:
   • Added over 40 headers covering IP spoofing (e.g., X-Forwarded-For variants, CF-Connecting-IP), host spoofing, and method overrides.
   • Added support for {path} placeholders in header values and forced the request line to / when testing specific rewrite headers (like X-Rewrite-URL).
3. Evasion & Robustness:
   • Implemented random User-Agent rotation for every request using a list of 8 modern browsers to avoid signature-based blocks.
   • Updated the loader to ignore lines starting with # and blank lines in the payload text files, allowing for organized and documented payload lists.
   • Refactored request generation to use Burp's buildHttpMessage rather than string replacement, making it more robust against edge cases.

Impact

These changes improve the detection coverage against misconfigured reverse proxies and WAFs while reducing the chance of being blocked during scans.