Add vpatch-CVE-2025-31161 rule and test

[crowdsec-automation]

This rule detects the authentication bypass vulnerability in CrushFTP (CVE-2025-31161) by matching three key elements of the exploit:

1. URI Match: The rule checks if the request URI contains /webinterface/function/, which is the endpoint targeted by the exploit.
2. Command Parameter: It ensures the command argument in the query string equals getuserlist, which is the function abused for unauthorized access.
3. Authorization Header: The rule inspects the Authorization header for the presence of the string aws4-hmac-sha256 credential=crushadmin/, which is used in the exploit to impersonate the admin user.

All value: fields are lowercase, and the transform section includes lowercase to ensure case-insensitive matching. The rule uses contains and equals as appropriate, avoiding regex unless necessary. This approach minimizes false positives and negatives by tightly focusing on the exploit's unique characteristics. The test config and nuclei test template are adapted to expect a 403 response, as required.

Exploit URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31161.yaml