Add exec payload. Cleans up a lot of code.

Adds some yardocs and whatnot.
Whitespace tweak.
Refactor runCmd, allow js exec.

* Updates exec payload to not touch disk
* Adds XSS module that uses hiddenWindow (to avoid X-Frame-Options)
Update exec to be diskless.
Update firefox payloads to use async runCmd.
Always Use LHOST for Full URL in HTTP/S Stage

Redmine #8726 documents a change where the reverse HTTP/S
tries to bind LHOST and if it can not it does a hard stop

If it's expected that users will use ReverseListenerBind-
-Address then this commit addresses #8726 by patching the
HTTP/S stage with the host provided by the user in LHOST.

Currently ReverseListenerBindAddress (if used) is patched
into the stage. This makes for a broken HTTP/S session if
the user sets this option to 0.0.0.0.

With this commit--users can provide any LHOST they like
and set ReverseListenerBindAddress to 0.0.0.0 and things
will work.

This commit does not attempt to bring the HTTP/S handler
back to the old behavior of falling back to 0.0.0.0 when
it can't bind LHOST. I'd welcome the old behavior but I
leave it to you to decide what makes sense. :)
HTTP Handler Bind to 0.0.0.0 or ReverseListenerBindAddress

This commit returns the HTTP/S handler to its former semantic glory.
By default the HTTP/S handler will bind to :: or 0.0.0.0. If the
user specifies a ReverseListenerBindAddress then, instead, the
server will bind to that address.

The previous commit to change the URL to always reference LHOST
should go with this too. LHOST is always my intent of where the
stage should call home too. ReverseListenerBindAddress would make
sense as my intent as to where I want to bind to. The two options
shouldn't take on each other's meanings.
Cleanup - Remove bind_address from reverse_http.rb

This commit removes the now unused bind_address function from
reverse_http.rb. This function returns an array of hosts the handler
should attempt to bind to (e.g., [LHOST value, any])

Other handlers (e.g., reverse_tcp.rb) loop through these values until
they're able to start a server with that bind address.

The HTTP server doesn't work this way. It's setup to try one address
and that's it. It makes sense to have the HTTP server always bind to
0.0.0.0 by default as future modules run by the user may register
resources with the same HTTP server.
Honor LPORT as callback port for HTTP/S handler

This commit completes our quest to (optionally) decouple the stage's
callback parameters from the interface/port our handler binds to.

LPORT is now patched into the stage over ReverseListenerBindPort.
Use shell primitives instead of resorting to
echo hacks.
Landing #2825 [FixRM #8726]
Fix description to be accurate.
Change display message to show actual bind address

When running a http/https listener the address:port that was being
shown in the output was that which was passed to the victim as part
of the stager and not the actual listener address:port.

This commit fixes this so that the display is correct.
Remove Java target, since it no longer works.
Fix issue with incorrect parameter parsing

Code was looking for -s instead of -a when dealing with domain
queries. This commit fixes that.
Fix bug in the firefox/exec payload.
Add explicit require for JSON, so msfpayload runs.
Fixes #8732 by reading until EOF reached.

* use a lambda for cleaner iterator.
* also disables buffering, since we are reading byte-by-byte in the first place
and maintaining our own buffer (#data).
Oops, the default bufsize is 0 anyways.
Land #2820 - vTigerCRM SOAP AddEmailAttachment Arbitrary File Upload