feat: CAP-989: Port 5 optimized skills to web-security capability + aem-sling-exploitation

[GangGreenTemperTatum]

New skill: aem-sling-exploitation (97% review, 96% content eval)

• Sling selector abuse (rawcontent, listParagraphs, form CVE-2024-26029)
• Dispatcher bypass chains via selector/suffix manipulation
• JCR enumeration and QueryBuilder exploitation
• AEM-specific XSS gadgets (moment.js, jQuery .text(), javascript: URI)
• Reference files: dispatcher-bypass-patterns.md, xss-gadgets.md

Updated: blind-ssrf-chains (97% review, 95% content eval)

• Added constraint assessment table — agents evaluate SSRF primitive capabilities before attempting chains, preventing wasted cycles
• Replaced repo-local callback CLI references with CallbackClient tool
• Consolidated duplicate examples, added Gopher Redis/FastCGI chain

Updated: dompurify-mxss-bypass (90% review, 100% content eval)

• Added jQuery .text() post-sanitization bypass (not mXSS, data flow bug)
• Added 8-step systematic workflow with validation checkpoints

Updated: dom-vulnerability-detection (92% review, 88% content eval)

• Added library gadgets: jQuery .text() re-decoding, moment.js format injection, javascript: URI hostname population bypass
• Added workflow feedback loops and expanded CSTI guidance

Updated: dom-vulnerability-static-analysis (92% review, 87% content eval)

• Extracted GADGETS.md reference file for progressive disclosure
• Added cross-validation step between grep and AST results
• moment.js detection: 38% → 100% with GADGETS.md content

All skills eval-validated via tessl (activation + content evals on claude-sonnet-4-6). Chain With sections cleaned for capability context.