Expand XSS payloads: registry, more vectors, and usage notes

[dguerri]

Summary

Expands the XSS Payloads page from 8 hardcoded payloads to 26, organized into category tabs, with per-payload usage examples, caveats, and "when it works" hints.

Changes

• New front-end/src/libs/payloads.js: single registry of 26 payload definitions (the original 8 preserved verbatim, plus 18 new), each with a generator function, usage example, caveats, and a "when it works" hint. Includes JS obfuscation helpers (case_mix, entity_encode, from_char_code) so WAF-bypass variants are generated on the fly.
• front-end/src/pages/XSSPayloads.vue rewritten as a thin renderer with category tabs (Attribute Breakouts, URI / Link-Based, WAF & Filter Bypass, DOM-Based, All) and cards showing the payload, copy button, and example/caveats/hints.
• front-end/test/payloads.test.js: plain-Node test suite (304 checks) covering payload structure, golden strings for the original payloads, and per-category behavior.

Payload categories

• Attribute Breakouts — svg onload, details ontoggle, body onload, marquee onstart, select autofocus, etc.
• URI / Link-Based — javascript: URIs, meta refresh, data: iframe, svg xlink:href
• WAF & Filter Bypass — case-mixing, entity-encoded breakouts, no-space onerror, protocol-relative script src=//, String.fromCharCode, backtick template literals
• DOM-Based — innerHTML/jQuery .html() sink, postMessage receiver

Testing

node front-end/test/payloads.test.js → 304 checks pass. No new dependencies.