Add capture action to @detectXSS operator

[victorhora]

Proposed fix for #1482.

Do notice that the API for @detectXSS in libInjection is still in Alpha stage so there's some missing features when compared with @detectSQLi.

In this case, there's no "fingerprint" returned from libInjection API to be fed into a "capture" action to tell us exactly what triggered the match like it's done with libinjection_sqli

So this proposed "capture" action would fill TX.0 with the full analyzed parameter value (var->value) when libinjection_xss returns true.

[fgsch]

Is this any different to using MATCHED_VAR?

[victorhora]

In this context, no @fgsch. But I'm not sure if there's much more we can do as the "API" looks limited in this aspect as of now.

But there's a chance I'm missing something, so let's see what others have to say :)

[zimmerle]

Merged. Thanks!