[emmanuelgautier]

Closes #14.

Adds templateinjection.header_ssti, a new aggressive-suite check (runs only with --aggressive) that detects when a reverse proxy renders a template engine over request headers it reflects back — e.g. Caddy's templates directive evaluating Go/sprig syntax in a reflected Referer.

It injects a benign arithmetic expression (7919*8039) in four engine syntaxes ({{ }}, {{mul }}, ${ }, #{ }) into Referer, User-Agent, and X-Forwarded-Host, and flags a finding only when the evaluated product appears in the response while absent from a clean control — confirming evaluation rather than reflection. The probe is non-destructive: no file reads, env access, or other side effects.

Checklist coverage

• Detect templating directives that render request headers server-side (Caddy templates)
• Safe SSTI probes via reflected headers (Referer, etc.) using non-destructive expressions
• Probe set covers other engines (Jinja2/Twig/Nunjucks, JSP/Spring EL, Ruby/Thymeleaf) exposing similar dynamic-response templating

Includes registration, a category test, and a docs page.