* feat(modules): add host-header injection and xxe probe modules
host-header-injection sets an rfc 2606 .invalid marker in the forwarded-host
headers and fires only when it comes back inside an absolute-url construct
(href/src/action/content/url), so a benign echo into text or an attribute cannot
trigger it. xxe-error-based expands a SYSTEM entity pointing at a local file and
matches only that file's contents, so an echo of the payload (a path string)
cannot satisfy it.
* chore(modules): trim redundant module header comments
drop the leading comment restating id/name on host-header-injection and xxe-error-based
