Add vpatch-CVE-2024-38653 rule and test

[crowdsec-automation]

This rule detects exploitation attempts of the Ivanti Avalanche SmartDeviceServer XXE vulnerability (CVE-2024-38653). The detection logic is as follows:

• The URI must exactly match /mdm/checkin, as this is the vulnerable endpoint.
• The Content-Type header must contain application/xml, indicating an XML payload is being sent.
• The raw body of the request must contain the string <!doctype (case-insensitive), which is a strong indicator of an XML External Entity (XXE) attack, as XXE payloads require a DOCTYPE declaration.

The rule uses lowercase transformation for all relevant fields to ensure case-insensitive matching and minimize false negatives. The matchers are chosen to be as specific as possible to the exploit pattern, reducing the risk of false positives. No regex or complex logic is used, and all values are in lowercase as required. The test config and nuclei test template are adapted to expect a 403 response, as per the guidelines.

Exploit URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38653.yaml