Report vuln for apache_mod_cgi_bash_env

Now with fewer false positives! It's kinda like a check method.
@wvu-r7 yeah! the first one just with the marker in the user agent, to be sure it's not being echo'ed :)