Report vuln for apache_mod_cgi_bash_env

Now with fewer false positives! It's kinda like a check method.
@wvu-r7 or just one request, in this case, worths to do a better regex, to verify the user-agent isn't being echo'ed as is!