Add CVE-2025-6058 rule and test

[crowdsec-automation]

This rule detects unauthenticated arbitrary file uploads in the WPBookit WordPress plugin (CVE-2025-6058). The attack is performed by sending a POST request to /wp-admin/admin-ajax.php with the action parameter set to wpb_ajax_post and the route_name parameter set to add_booking_type. The malicious file is uploaded as a .php file via the cover_image_img form field.

• The first rule block matches requests to the vulnerable endpoint /wp-admin/admin-ajax.php.
• The second and third rule blocks ensure the request is specifically for the vulnerable action and route.
• The fourth rule block checks that a file with a .php extension is being uploaded, which is indicative of an attempt to upload executable code.

All value: fields are lowercase, and transform includes lowercase where applicable. The rule uses contains, equals, and endsWith for matching, avoiding regex unless necessary, and is case-insensitive. This approach minimizes false positives and negatives by tightly focusing on the exploit vector described in the nuclei template.