Improve detection for existing CVE checks

[UncleJ4ck]

Second focused split from #12, this one covering the "improve the check of some vulns" point. Each of these is an existing module whose detection was version-only or prone to a false positive; this swaps in a behavioral differential (timing delta, real side effect, or a negative control) so --check reflects the actual state of the target.

• CVE-2022-31061: differential-timing confirmation of the login LDAP-auth SQL injection.
• CVE-2022-35914: actually runs a shell command via hhook=exec and matches an echoed token (unauth RCE), instead of inferring.
• CVE-2023-41323: unauthenticated username enumeration via a name[0]=LIKE differential.
• CVE-2024-27937: confirms the dropdown IDOR by leaking a bcrypt hash with displaywith=password.
• CVE-2024-37149: confirms the plugin-directory traversal is accepted (loader RCE reachable).
• CVE-2024-50339: recovers instance_uuid unauth and reads a dashboard card with a forged embed token.
• CVE-2025-24799: differential-timing confirmation of the inventory deviceid SQL injection.
• CVE-2025-32786: unauthenticated time-based SQLi via setStatus machineid.

All use self.get/self.post and keep the existing @author. Checks were exercised against live 10.0.x vulnerable/patched pairs.